How to resolve the Format String Error alert in OWASP ZAP for a web application (ASP.NET C#)?

Question

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.

@Html.TextBoxFor(m => m.Username, new { @maxlength="30"})

When I run OWASP ZAP, it gives me an alert with the following description.

A Format String error occurs when the submitted data of an input string is evaluated as a command by the application

Potential Format String Error. The script closed the connection on a /%s

But when I remove @maxlength="30", the alert goes away.

I've been trying to find the remediation for this alert, but I've read that Format String vulnerability doesn't really exist in C#: Do format string vulnerabilities exist in C# or Java? .

Is it just a "potential" error and nothing to worry about because it's in C#? Or.. if this is something that needs to be taken care of, what can be done to resolve this alert from OWASP ZAP? (I'd believe removing @maxlength is not a solution).

Answer 1

It could be a False Positive. You can mark the alert as such, just double click it and set Confidence to False Positive.

If you're seeing it a lot you could go into the Scan Policy and disable that one scan rule.

You could also grab the Alert Filters addon and use it to tweak things.

Lastly ZAP is Open Source so you could always check the source of the scan rule (link below) and see if there's a way to address the false positive or at least you could understand why it's coming up.

https://github.com/zaproxy/zap-extensions/blob/master/addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/FormatString.java