'Cordova readAsArrayBuffer - Checkmarx scan - Angular

During recent scan of Checkmarx I get this kind of warning:

The input obtained via class="row"> in the file frontend\src\app\feature-module\uploader\csv-uploader.component.html at line 29 is used to determine the file to be read by readHashAndUpload in the file frontend\src\app\feature-module\uploader\csv-uploader.component.ts at line 227, potentially disclosing the contents of that file.

The input data to which warning apply is uploaded with usual input: ( csv-uploader.component.ts)

<input id="browseFileInput"
         type="file"
         accept=".csv"
         *ngIf="showBrowseInput"
         [hidden]="true"
         (change)="selectCsvFile($event.target.files)">

This is how selectCsvFile function looks like:

selectCsvFile(fileList: FileList) {
if (fileList == null) {
  return;
}

this.currentFile = fileList.item(0);
this.isFileSelected = true;
this.showUploadButton = true;
this.showWorkFlowId = false;

}

Further fuctions leading to the upload of the file to the backend are as follows:

validateAndUpload() {
if (!this.isExtensionMatch('csv')) {
  this.showToastGlobalNotification(this.wrongExtensionNotificationToast);
  return;
}

if (this.isFileNameToLong()) {
  this.showToastGlobalNotification(this.fileNameTooLongNotificationToast);
  return;
}

if (this.isFileEmpty()) {
  this.showToastGlobalNotification(this.emptyFileNotificationToast);
  return;
}

if (this.isMaxSizeExceeded()) {
  this.showToastGlobalNotification(this.tooBigFileNotificationToast);
  return;
}

this.readHashAndUpload();}



private readHashAndUpload() {
    const reader = new FileReader();

    reader.onloadend = () => {
      this.calculateHash(reader.result);
      this.uploadFile();
      this.isFileSelected = false;
      this.showUploadButton = false;
    };

    reader.readAsArrayBuffer(this.currentFile);
  }

private uploadFile() {

let params = new HttpParams();
params = params.append('dataType', this.chosenDataType);
this.uploaderService.uploadFile(this.currentFile, this.uploadUrl, this.fileHash.toString(), params)
  .pipe(
    catchError(
      (errorResponse: HttpErrorResponse) => {
        this.showToastGlobalNotification(this.createErrorResponseToast(errorResponse.error.message));
        return of();
      })
  )
  .subscribe((response: ResponseWrapper) => {
    this.showWorkFlowId = true;
    this.workFlowId = response.uploadId;
    this.showToastGlobalNotification(this.createSuccessfulResponseToast(response.message));
  });

}

Final service class is named UploaderService and looks like this:

    @Injectable()
export class UploaderService {

  constructor(private http: HttpClient) {
  }

  uploadFile(file: File, url: string, hash?: string, parameters?: HttpParams): Observable<ResponseWrapper> {

    const formData: FormData = new FormData();
    formData.append('file', file);

    if (hash) {
      formData.append('hash', hash);
    }

    return this.http.post<ResponseWrapper>(url, formData, {params: parameters});
  }
}

I was wondering if there was any way to get rid of this warning. I've sanitized warnings in Checkmarx for Java before, but I don't have the faintest idea how to approach this. Any advice?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source