How to fix Veracode error:Information Exposure Through Sent Data

Question

Veracode fails the following line of code:

string server = Decryptor.Decrypt(ConfigurationManager.AppSettings["ConnectionPoint"]);

System.Net.HttpWebRequest objRequest = (System.Net.HttpWebRequest)System.Net.WebRequest.Create(server);

Does anyone have any ideas on how to fix that?

Answer 1

Try to encode the string server as:

string server  = Decryptor.Decrypt(ConfigurationManager.AppSettings["ConnectionPoint"]).HTMLEncode();

Answer 2

Veracode considers information stored in the config file as sensitive information. So try to store "ConnectionPoint" anywhere other than config file