纠正VB.NET中的Veracode CWE ID 117（日志输出中和不当）

Question

    Public Function WriteToEventLog(ByVal Entry As String, Optional ByVal AppName As String = "adCoreLibrary", Optional ByVal EventType As EventLogEntryType = Nothing, Optional ByVal LogName As String = "Application", Optional ByVal EventID As Integer = 0, Optional ByVal TaskCategory As TaskCategory = 0) As Boolean

    Dim objEventLog As New EventLog()

    Try
        ' We will try and create our own event log but if not, use the optional default 
        If Not EventLog.SourceExists(AppName) Then
            EventLog.CreateEventSource(AppName, LogName)
        End If

        ' Initialise event log
        objEventLog.BeginInit()

        ' Set the source
        objEventLog.Source = AppName

        ' Write entry
        If Entry IsNot Nothing Then
            ' THE FOLLOWING LINE IS BEING FLAGGED AS CWE-117 NON-COMPLIANT
            objEventLog.WriteEntry(Entry.Replace(vbLf, "_"c).Replace(vbCr, "_"c).Replace(vbTab, "_"c), EventType, EventID, CShort(TaskCategory))
        End If


        ' End initialisation
        objEventLog.EndInit()

        Return True
        Exit Function

    Catch ex As Exception
        If CType(My.Settings.adLogMode, LogMode) <> adCoreLogging.LogMode.Empty Then
            My.Application.Log.WriteEntry("An error occured when trying to write to the Windows Event Log: " & ex.Message.ToString)
            Return False
        End If
    Finally
    End Try

    ' If we get here, we've had a problem
    Return False

End Function

Answer 1

嗯，对于任何一个偶然发现这个的人....我找到了答案。

我不得不将以下内容替换为令人不快的行（在导入System.web之后）：

Dim newEntry As String = HttpUtility.HtmlEncode(Entry)
objEventLog.WriteEntry(newEntry, EventType, EventID, CShort(TaskCategory))

我不知道为什么Veracode允许这样做，因为本质上还是一样的，但是，我们在那里。