title: External Control of System or Configuration Setting
body: <p>(Sorry, if this is a dumb question....)</p>
  
  <p>Veracode reports my website has a security issue which relates to use connection string from web.config.</p>
  
  <p>Here is my code. </p>
  
  <pre><code>Public Function ExecuteScalar(ByVal sql As String) As Object
      Dim obj As Object = Nothing
  
      Try
          Dim connStr as String = ConfigurationManager.ConnectionStrings("mydatabase").ConnectionString
          Using conn As New SqlConnection(connStr)   '''Veracode reports the issue come from this line
              conn.Open()
              If conn IsNot Nothing Then
                  '''execute my sql
              End If
          End Using
  
      Catch ex As Exception
          Throw ex
      End Try
  
      Return obj
  End Function
  </code></pre>
  
  <p>Veracode said:</p>
  
  <blockquote>
    <p>This call to
    system_data_dll.System.Data.SqlClient.SqlConnection.!newinit_0_1()
    allows external control of system settings. The argument to the
    function is constructed using user-supplied input, which can disrupt
    service or cause an application to behave in unexpected ways. The
    first argument to !newinit_0_1() contains tainted data from the
    variable connStr. The tainted data originated from earlier calls to
    system_web_dll.system.web.httprequest.get_item,
    system_data_dll.system.data.common.dbdataadapter.fill,
    system_data_dll.system.data.sqlclient.sqlcommand.executescalar, and
    fmmobile8_dll.virtualcontroller.vc_wcfentry.</p>
  </blockquote>
  
  <p>Remediation: </p>
  
  <blockquote>
    <p>Never allow user-supplied or otherwise untrusted data to control
    system-level settings. Always validate user-supplied input to ensure
    that it conforms to the expected format, using centralized data
    validation routines when possible.</p>
  </blockquote>
  
  <p>The same isuse was reported by CWE: <a href="http://cwe.mitre.org/data/definitions/15.html" rel="nofollow noreferrer">http://cwe.mitre.org/data/definitions/15.html</a></p>
  
  <p>OK, the suggestion from Veracode said that I should check the format of connection string before using it to create SqlConnection object.</p>
  
  <p>I also asked Google professor about how to check format of connection string. But the returned results said that we should create SqlConnection object, then open it. </p>
  
  <p>If the response is OK, the connection string also means a valid format. Otherwise, the connection string is invalid.</p>
  
  <p>Unfortunately, Veracode does not accept this answer.</p>
  
  <p>So, my question is that:</p>
  
  <p>Should we check the format of connection string before creating SqlConnection object (as Veracode said)? If yes, how?</p>