0

I have a web application with a log in page. In the log in page, I've set maxlength for the username input and the password input, which looks like the code below.

@Html.TextBoxFor(m => m.Username, new { @maxlength="30"})

When I run OWASP ZAP, it gives me an alert with the following description.

A Format String error occurs when the submitted data of an input string is evaluated as a command by the application

Potential Format String Error. The script closed the connection on a /%s

But when I remove @maxlength="30", the alert goes away.

I've been trying to find the remediation for this alert, but I've read that Format String vulnerability doesn't really exist in C#: Do format string vulnerabilities exist in C# or Java? .

Is it just a "potential" error and nothing to worry about because it's in C#? Or.. if this is something that needs to be taken care of, what can be done to resolve this alert from OWASP ZAP? (I'd believe removing @maxlength is not a solution).

2
  • As your link says, the answer should be "no". Scanners are going to generate many false positives. Look at the description; could there be another reason the connection is closed (e.g. /%s doesn't pass validation)? Jan 24, 2020 at 2:10
  • I think the scan thinks your validation script has crashed when the maxlength value has been hit... but it's just the browser cutting off input and so not firing the normal asp.net client-side validation code. (I suspect format string attacks MIGHT be possible in web assembly, so it flags it just in case) Oct 13, 2023 at 18:56

1 Answer 1

0

It could be a False Positive. You can mark the alert as such, just double click it and set Confidence to False Positive.

If you're seeing it a lot you could go into the Scan Policy and disable that one scan rule.

You could also grab the Alert Filters addon and use it to tweak things.

Lastly ZAP is Open Source so you could always check the source of the scan rule (link below) and see if there's a way to address the false positive or at least you could understand why it's coming up.

https://github.com/zaproxy/zap-extensions/blob/master/addOns/ascanrules/src/main/java/org/zaproxy/zap/extension/ascanrules/FormatString.java

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .