'Cordova readAsArrayBuffer - Checkmarx scan - Angular
During recent scan of Checkmarx I get this kind of warning:
The input obtained via class="row"> in the file frontend\src\app\feature-module\uploader\csv-uploader.component.html at line 29 is used to determine the file to be read by readHashAndUpload in the file frontend\src\app\feature-module\uploader\csv-uploader.component.ts at line 227, potentially disclosing the contents of that file.
The input data to which warning apply is uploaded with usual input: ( csv-uploader.component.ts)
<input id="browseFileInput"
type="file"
accept=".csv"
*ngIf="showBrowseInput"
[hidden]="true"
(change)="selectCsvFile($event.target.files)">
This is how selectCsvFile function looks like:
selectCsvFile(fileList: FileList) {
if (fileList == null) {
return;
}
this.currentFile = fileList.item(0);
this.isFileSelected = true;
this.showUploadButton = true;
this.showWorkFlowId = false;
}
Further fuctions leading to the upload of the file to the backend are as follows:
validateAndUpload() {
if (!this.isExtensionMatch('csv')) {
this.showToastGlobalNotification(this.wrongExtensionNotificationToast);
return;
}
if (this.isFileNameToLong()) {
this.showToastGlobalNotification(this.fileNameTooLongNotificationToast);
return;
}
if (this.isFileEmpty()) {
this.showToastGlobalNotification(this.emptyFileNotificationToast);
return;
}
if (this.isMaxSizeExceeded()) {
this.showToastGlobalNotification(this.tooBigFileNotificationToast);
return;
}
this.readHashAndUpload();}
private readHashAndUpload() {
const reader = new FileReader();
reader.onloadend = () => {
this.calculateHash(reader.result);
this.uploadFile();
this.isFileSelected = false;
this.showUploadButton = false;
};
reader.readAsArrayBuffer(this.currentFile);
}
private uploadFile() {
let params = new HttpParams();
params = params.append('dataType', this.chosenDataType);
this.uploaderService.uploadFile(this.currentFile, this.uploadUrl, this.fileHash.toString(), params)
.pipe(
catchError(
(errorResponse: HttpErrorResponse) => {
this.showToastGlobalNotification(this.createErrorResponseToast(errorResponse.error.message));
return of();
})
)
.subscribe((response: ResponseWrapper) => {
this.showWorkFlowId = true;
this.workFlowId = response.uploadId;
this.showToastGlobalNotification(this.createSuccessfulResponseToast(response.message));
});
}
Final service class is named UploaderService and looks like this:
@Injectable()
export class UploaderService {
constructor(private http: HttpClient) {
}
uploadFile(file: File, url: string, hash?: string, parameters?: HttpParams): Observable<ResponseWrapper> {
const formData: FormData = new FormData();
formData.append('file', file);
if (hash) {
formData.append('hash', hash);
}
return this.http.post<ResponseWrapper>(url, formData, {params: parameters});
}
}
I was wondering if there was any way to get rid of this warning. I've sanitized warnings in Checkmarx for Java before, but I don't have the faintest idea how to approach this. Any advice?
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
