I have used following method to call stored procedures from my application and it is working perfectly.
The main issue is that when i run veracode on my application, it is giving me following error on ExecuteReader,
"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
The reference for resolving the issue is below,
"https://cwe.mitre.org/data/definitions/89.html"
As you can see there are no static queries in my following method and Parameters.Add is already being called to add the parameters for the stored procedure.
I have previously resolved this error by following the reference link solution on static queries parameters, but here in the below method there is no query involved so i
am confused how to resolve it.
Can anyone guide me the solution to dissolve this error? I don't want to change my method for calling stored procedures as it will impact my whole production application.
public static List<Dictionary<string, object>> callProcForOutput(string procName, Dictionary<string, string> procParam, SqlConnection conn)
{
List<Dictionary<string, object>> outvalues = new List<Dictionary<string, object>>();
List<SqlParameter> parameters = new List<SqlParameter>();
using (SqlCommand command = new SqlCommand(procName, conn))
{
procParam.ForEach(x => parameters.Add(new SqlParameter(x.Key, (object)x.Value)));
command.CommandTimeout = 90;
command.CommandType = CommandType.StoredProcedure;
foreach (SqlParameter parameter in parameters)
{
command.Parameters.Add(parameter);
}
command.Transaction = TransactionManager.TransManager.Transaction;
SqlDataReader rdr = command.ExecuteReader();
Dictionary<string, object> keyvalues = new Dictionary<string, object>();
while (rdr.Read())
{
keyvalues = Enumerable.Range(0, rdr.FieldCount).ToDictionary(rdr.GetName, rdr.GetValue);
outvalues.Add(keyvalues);
}
rdr.Close();
return outvalues;
}
}