ASP.NET Prevent exposure of sensitive data

Question

I'm doing a asp.net/c# project. Currently I have one web page with a label control lblData to display content from a string variable. Please look at the code block below:

string strData = "Data";
lblData.Text = strData;

When I run Parasoft tool to scan the project, I get result as below:

Security issue: Prevent exposure of sensitive data

Leakage of ToString() result via web control.

I think my code violated some standard security practice but I'm not sure how to fix it. Really appreciate for your time and help.

Answer 1

Is this full code, or you have simplified your example? I am asking because I was not able to get any violation on your example.

After modifying your example to something like:

protected void Foo(object o)
{
    string strData = "Data" + o.ToString() ;
    lblData.Text = strData;
}

I am getting following violation:

Violation: Leakage of ToString() result ("strData") via web control

To fix that violation you will need to validate exposed data, it is done by defining in rule configuration validating method and passing your data to that method(by default all methods with prefix 'validate' are treated as validating) so if you modify your code to something like:

protected void Foo(object o)
{
    string strData = "Data" + o.ToString() ;
    validateStrData(strData);
    lblData.Text = strData;
}
private void validateStrData(string strData)
{
    //some validating logic
}

then violation should not be reported