search

pumasecurity / puma-scan

Puma Scan is a software security Visual Studio extension that provides real time, continuous source code analysis as development teams write code. Vulnerabilities are immediately displayed in the development environment as spell check and compiler warnings, preventing security bugs from entering your applications.
https://www.pumascan.com
Mozilla Public License 2.0
446 stars 80 forks source link

SEC0108 warning false reporting #67

Open AdamRiddick opened 4 years ago

AdamRiddick commented 4 years ago

SEC0108 is regarding SQL injection when using string concatenation. However, the analyzer is false reporting when a constant value is passed into the procedure;

private const string ProcedureName = "MyProcedureName";

public Task ExecuteProcedureAsync()
{
    return this.Context.Database.ExecuteSqlCommandAsync(ProcedureName);
}

Note that using the procedure name instead of the constant does not report a warning.