How to fix HP Fortify ( Static Code Analyzer) Vulnerabilities in T4MVC generated files

[EemranLatif]

I have MVC project in .Net Framework 4.6.2. When I run HP Fortify (Static Code Analyzer) Scan on my Project, I get "Mass Assignment : insecure Binder Cofiguration" Vulnerability in my myControll.generated.cs File. This file is generated by T4MVC Template. To fix vulnerability, I have couple of options, but those options I can use in myControll.generated.cs file, once I run template again, this file will be overridden.

Public override System.Web.Mvc.ActionResult Edit(Proj.Models.UserViewModel viewModel ){
var callInfor = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.Edit);
ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "modelView" , modelView);
retur callInfo;
}

Please suggest.

[davidebbo]

Where exactly does this piece of code come from? It has errors like retur instead of return, which would guarantee that it won't compile, so I doubt this is what T4MVC would generate. If you mean to include some T4MVC generated code, please include it exactly, and use proper markdown to format it.

[EemranLatif]

This could be Typo. I could not copy & paste actual code. We have around 1000 errors, only because of T4MVC in multiple applications. We are able to compile & even run on production, but when we run HP fortify for security reason then we see these error. Thanks, Imran

…

On Oct 29, 2018, at 4:31 PM, David Ebbo ***@***.***> wrote: Where exactly does this piece of code come from? It has errors like retur instead of return, which would guarantee that it won't compile, so I doubt this is what T4MVC would generate. If you mean to include some T4MVC generated code, please include it exactly, and use proper markdown to format it. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub, or mute the thread.

[davidebbo]

What is preventing you from copying the actual code? I don't mind looking deeper at this issue if you clean it up as suggested.

[EemranLatif]

Following code is from Controller class where I am referring T4MVC generated code.

public partial class UserController { Public Virtual ActionResult Edit([Bind(Include = "Name, Phone")] UseViewModel viewModel){ . . . return View(Views.Edit, viewModel) } } // End of class

Following Partial class is generated by T4MVC Template. It's look like, T4MVC Template is not including Bind[()], when it's generating code. Now when I run Fortify Scan, it complaint about "Insecure Binding".
Do we have any settings where we can include whole method declaration to T4MVC generated code?

`
public partial class UserController
{

public override System.Web.Mvc.ActionResult Edit(Proj.Models.UserViewModel viewModel )
{
var callInfor = new T4MVC_System_Web_Mvc_ActionResult(Area, Name, ActionNames.Edit);
ModelUnbinderHelpers.AddRouteValues(callInfo.RouteValueDictionary, "modelView" , modelView);
return callInfo;
}
} // class end
`
Thanks

[davidebbo]

Please see https://guides.github.com/features/mastering-markdown/ for instructions on formatting your code on GitHub so it's easily readable.

What I would suggest here is:

• Figure out exactly what this error means
• How different should the code be to avoid this?
• Or if it's benign, find is there is a way to mark the code such that the analyzer will ignore it
• Send PR accordingly