CODEWITHSUNDEEP
javasecurityveracode
AWS_Developer
AWS_Developer

Reputation: 856

How to fix Information Exposure Through Sent Data flaw in Java Web application

I am getting a Veracode Information Exposure via Sent Data flaw. My code is: 

String companyName = System.getProperty(EPMIConstants.COMPANY_NAME);

This System.getProperty(EPMIConstants.COMPANY_NAME) gets its value from a JVM argument hardcoded in the server itself.

The variable companyName causes this flaw.

Can someone please tell me how to avoid this flaw?

Upvotes: 1

Views: 7831

Answers (2)

fcerullo
fcerullo

Reputation: 681

I would recommend you to create a rule exception in Veracode so the false positive is not highlighted anymore.

Fabio

Upvotes: 1

fcerullo
fcerullo

Reputation: 681

Have a look at this:

http://cwe.mitre.org/data/definitions/201.html

It looks like this might be a false positive.

Fabio @fcerullo

Upvotes: 0

Related Questions