We Keep Coding

External Control of System or Configuration Setting (CWE ID 15)

We had security threat issue when scanning applications in Veracode. Got "External Control of System or Configuration Setting (CWE ID 15)".
Scan reported for using (var connection = new SqlConnection(connectionString))
we are checking whether "SQLConnectionExists" by passing connection string,
string sqlConnString = SqlHelper.GetSQLConnectionString(input.ServerName, dbName, isWinAuth, input.UserName, input.Password);
if (!DBUtil.CheckSQLConnectionExists(sqlConnString))
{
_ValidationMessage += "Database Unreachable \n";
isValid = false;
}
public static bool CheckSQLConnectionExists(string connectionString)
{
bool isExist = false;
try
{
using (var connection = new SqlConnection(connectionString))
{
connection.Open();
connection.Close();
isExist = true;
}
}
catch (Exception ex)
{
Logger.Instance.Log(LogLevel.EXCEPTION, "CheckSQLConnectionExists Exception : " + ex.Message);
}
return isExist;
}
public static string GetSQLConnectionString(string servername, string db, bool isWinAuth, string username, string password)
{
System.Data.SqlClient.SqlConnectionStringBuilder builder = new System.Data.SqlClient.SqlConnectionStringBuilder();
builder["Data Source"] = servername;
builder["Initial Catalog"] = db;
if (isWinAuth)
{
builder["Integrated Security"] = "SSPI";
builder["Trusted_Connection"] = "Yes";
}
else
{
builder["Persist Security Info"] = false;
builder["User ID"] = username;
builder["Password"] = password;
}
return builder.ConnectionString;
}
In this line using (var connection = new SqlConnection(connectionString)) we got error in security scan. Could you please some one provide suggestions to resolve this Veracode error.

Veracode detects input.ServerName, input.UserName and input.Password to be user-controlled which is a risk.
Ensure validation is implemented - if possible, compare against a whitelist or known predefined server names. Also, check if the entered (injected) Min Pool Size is larger than expected. Use framework classes such as the one that you used SqlConnectionStringBuilder
Propose this check as a mitigation afterwards.

Initialize database in code-first SQLite

Config that I set connectionstring to:
<connectionStrings>
<add name="default" connectionString="data source=database\data.db;" providerName="System.Data.SQLite" />
</connectionStrings>
But in myDbContext I change my database location to :
base.Database.Connection.ConnectionString = #"data source=" + AppVariable.myPath + #"database\data.db;";
After that when my app launch my tables are not created, where is the problem?

extract from my code with nuget package...no need of connection string and datasource...
using SQLite;
public string SQLitePath => Path.Combine(System.AppDomain.CurrentDomain.BaseDirectory, "xxxxx.sqlite");
try
{
using (var db = new SQLiteConnection(SQLitePath) { Trace = IsDebug })
{
List<TargetModel> test = db.Table<TargetModel>().Select(p => p).ToList();
return test;
}
}
catch (Exception ex)
{
BusinessLogger.Manage(ex);
return null;
}

Connecting to multiple SQL Servers dynamicly with C# Form?

I have some SQL Servers that is Identical exept for the data stored and i want to be able to change between them and if i add more i want to easy add them with a windows form.
I have done a database first and this is the connection string that was added to the App.config file. I changed the username and password for security reasons
<add name="MigrateDBFaktura3Entities"
connectionString="metadata=res://*/DB.ServerData.csdl|res://*/DB.ServerData.ssdl|res://*/DB.ServerData.msl;provider=System.Data.SqlClient;provider connection string="data source=FASTEC-ATTEST\SQLEXPRESS;initial catalog=MigrateDBFaktura5;persist security info=True;user id=**;password=**;MultipleActiveResultSets=True;App=EntityFramework""
providerName="System.Data.EntityClient" />
Is there a easy way to change where i should get the data from?
I was thinking to use a combobox where i could chose what SQL Server it should get the data from.
If i manualy change the connection string it works. but how do i do it with code?

you can utilize class EntityConnectionStringBuilder to build your connection string. refer more here https://msdn.microsoft.com/en-us/library/orm-9780596520281-01-16.aspx and Programmatic Connection Strings in Entity Framework 6
// Specify the provider name, server and database.
string providerName = "System.Data.SqlClient";
string serverName = ".";
string databaseName = "AdventureWorks";
// Initialize the connection string builder for the
// underlying provider.
SqlConnectionStringBuilder sqlBuilder =
new SqlConnectionStringBuilder();
// Set the properties for the data source.
sqlBuilder.DataSource = serverName;
sqlBuilder.InitialCatalog = databaseName;
sqlBuilder.IntegratedSecurity = true;
// Build the SqlConnection connection string.
string providerString = sqlBuilder.ToString();
// Initialize the EntityConnectionStringBuilder.
EntityConnectionStringBuilder entityBuilder =
new EntityConnectionStringBuilder();
//Set the provider name.
entityBuilder.Provider = providerName;
// Set the provider-specific connection string.
entityBuilder.ProviderConnectionString = providerString;
// Set the Metadata location.
entityBuilder.Metadata = #"res://*/AdventureWorksModel.csdl|
res://*/AdventureWorksModel.ssdl|
res://*/AdventureWorksModel.msl";
Console.WriteLine(entityBuilder.ToString());
using (EntityConnection conn =
new EntityConnection(entityBuilder.ToString()))
{
conn.Open();
Console.WriteLine("Just testing the connection.");
conn.Close();
}

What i did to make it work.
In the Context file i changed
public MigrateDBFaktura3Entities ()
: base("name=MigrateDBFaktura3Entities")
{
}
to
public MigrateDBFaktura3Entities (string connectionString)
: base(connectionString)
{
}
Then i made a HelperClass
class ConnectionHelper
{
public static string CreateConnectionString(LocationModel LM, string metaData)
{
const string appName = "EntityFramework";
const string providerName = "System.Data.SqlClient";
SqlConnectionStringBuilder sqlBuilder = new SqlConnectionStringBuilder();
sqlBuilder.DataSource = LM.datasource;
sqlBuilder.InitialCatalog = LM.catalog;
sqlBuilder.UserID = LM.Username;
sqlBuilder.Password = LM.Password;
sqlBuilder.MultipleActiveResultSets = true;
sqlBuilder.PersistSecurityInfo = true;
sqlBuilder.ApplicationName = appName;
EntityConnectionStringBuilder efBuilder = new EntityConnectionStringBuilder();
efBuilder.Metadata = metaData;
efBuilder.Provider = providerName;
efBuilder.ProviderConnectionString = sqlBuilder.ConnectionString;
var t = efBuilder.ConnectionString;
return efBuilder.ConnectionString;
}
public static FastecData CreateConnection(LocationModel locationmodel, string metaData = "res://*/DB.ServerData.csdl|res://*/DB.ServerData.ssdl|res://*/DB.ServerData.msl")
{
return new FastecData(ConnectionHelper.CreateConnectionString(locationmodel, metaData));
}
}
The LocationModel is Database that purly contains the data for the different servers i will connect to to get data from.
Then when i need to connect to it i only need to
MigrateDBFaktura3Entities db = ConnectionHelper.CreateConnection(CurrentLocation)
where CurrentLocation is a LocationModel

Entity Framework set connection string at runtime

I have been trying to get this work for last couple of days with no success.
This is what I have done so far.
string providerName = "System.Data.SqlClient";
string serverName = serverIPAddress;
string databaseName = myDBName;
SqlConnectionStringBuilder sqlBuilder = new SqlConnectionStringBuilder();
sqlBuilder.DataSource = serverName;
sqlBuilder.InitialCatalog = databaseName;
sqlBuilder.PersistSecurityInfo = true;
sqlBuilder.MultipleActiveResultSets = true;
sqlBuilder.UserID = "sa";
sqlBuilder.Password = saPassword;
string providerString = sqlBuilder.ToString();
EntityConnectionStringBuilder entityBuilder = new EntityConnectionStringBuilder();
entityBuilder.Provider = providerName;
entityBuilder.ProviderConnectionString = providerString;
entityBuilder.Metadata = "res://*/TUModel.myModel.csdl|res://*/TUModel.myModel.ssdl|res://*/TUModel.myModel.msl";
myEntities ctx = new myEntities(entityBuilder.ConnectionString);
The constructor in entity class look like
public myEntities(string connectionString) : base("name=myEntities")
{
}
When I run there is no error. However if I delete 'myEntities' connection string from app.config, then it throws exception. If I leave it as it is then it ignores the connection string in the code and use the one in app.config.
Any help would be greatly appreciated.

Your context constructor isn't passing your connection string in, instead it is passing through a fixed value of name=myEntities. Change it to this:
public myEntities(string connectionString) : base(connectionString)
{
}

error when trying to programatically build connection string for EF 6

I am using EF ver 6 and I am trying to build my connection string programatically as follows:
public GlContext() : base(ConnectionString()) { }
private static string ConnectionString()
{
SqlConnectionStringBuilder sqlBuilder = new sqlConnectionStringBuilder();
sqlBuilder.DataSource = "myserver";
sqlBuilder.InitialCatalog = "GLPROD";
sqlBuilder.PersistSecurityInfo = true;
sqlBuilder.IntegratedSecurity = false;
sqlBuilder.MultipleActiveResultSets = true;
sqlBuilder.UserID = "user";
sqlBuilder.Password = "pwd";
sqlBuilder.ApplicationName = "EntityFramework";
EntityConnectionStringBuilder entityBuilder = new EntityConnectionStringBuilder();
entityBuilder.ProviderConnectionString = sqlBuilder.ToString();
entityBuilder.Provider = "System.Data.SqlClient";
return entityBuilder.ToString();
}
When trying to use GlContext I get this error:
keyword not supported: 'provider'
I have spent hours trying to figure out why this code would not work... if I load it from app.config then it works well. Any suggestion is appreciated.
Thanks

EntityConnectionStringBuilder should be used for EDMX model and for Code First model (DbContext based ones) you should use SqlConnectionStringBuilder.