0

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.

@Html.TextBoxFor(m => m.Username, new { @maxlength="30"})

When I run OWASP ZAP, it gives me an alert with the following description.

A Format String error occurs when the submitted data of an input string is evaluated as a command by the application

Potential Format String Error. The script closed the connection on a /%s

But when I remove @maxlength="30", the alert goes away.

I've been trying to find the remediation for this alert, but I've read that Format String vulnerability doesn't really exist in C#: Do format string vulnerabilities exist in C# or Java? .

Is it just a "potential" error and nothing to worry about because it's in C#? Or.. if this is something that needs to be taken care of, what can be done to resolve this alert from OWASP ZAP? (I'd believe removing @maxlength is not a solution).

  • As your link says, the answer should be "no". Scanners are going to generate many false positives. Look at the description; could there be another reason the connection is closed (e.g. /%s doesn't pass validation)? – multithr3at3d Jan 24 at 2:10
0

It could be a False Positive. You can mark the alert as such, just double click it and set Confidence to False Positive.

If you're seeing it a lot you could go into the Scan Policy and disable that one scan rule.

You could also grab the Alert Filters addon and use it to tweak things.

Lastly ZAP is Open Source so you could always check the source of the scan rule (link below) and see if there's a way to address the false positive or at least you could understand why it's coming up.

https://github.com/zaproxy/zap-extensions/blob/master/addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/FormatString.java

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.