External Control of System or Configuration Setting
<p>(Sorry, if this is a dumb question....)</p>

<p>Veracode reports my website has a security issue which relates to use connection string from web.config.</p>

<p>Here is my code. </p>

<pre><code>Public Function ExecuteScalar(ByVal sql As String) As Object
    Dim obj As Object = Nothing

    Try
        Dim connStr as String = ConfigurationManager.ConnectionStrings("mydatabase").ConnectionString
        Using conn As New SqlConnection(connStr)   '''Veracode reports the issue come from this line
            conn.Open()
            If conn IsNot Nothing Then
                '''execute my sql
            End If
        End Using

    Catch ex As Exception
        Throw ex
    End Try

    Return obj
End Function
</code></pre>

<p>Veracode said:</p>

<blockquote>
  <p>This call to
  system_data_dll.System.Data.SqlClient.SqlConnection.!newinit_0_1()
  allows external control of system settings. The argument to the
  function is constructed using user-supplied input, which can disrupt
  service or cause an application to behave in unexpected ways. The
  first argument to !newinit_0_1() contains tainted data from the
  variable connStr. The tainted data originated from earlier calls to
  system_web_dll.system.web.httprequest.get_item,
  system_data_dll.system.data.common.dbdataadapter.fill,
  system_data_dll.system.data.sqlclient.sqlcommand.executescalar, and
  fmmobile8_dll.virtualcontroller.vc_wcfentry.</p>
</blockquote>

<p>Remediation: </p>

<blockquote>
  <p>Never allow user-supplied or otherwise untrusted data to control
  system-level settings. Always validate user-supplied input to ensure
  that it conforms to the expected format, using centralized data
  validation routines when possible.</p>
</blockquote>

<p>The same isuse was reported by CWE: <a href="http://cwe.mitre.org/data/definitions/15.html" rel="nofollow noreferrer">http://cwe.mitre.org/data/definitions/15.html</a></p>

<p>OK, the suggestion from Veracode said that I should check the format of connection string before using it to create SqlConnection object.</p>

<p>I also asked Google professor about how to check format of connection string. But the returned results said that we should create SqlConnection object, then open it. </p>

<p>If the response is OK, the connection string also means a valid format. Otherwise, the connection string is invalid.</p>

<p>Unfortunately, Veracode does not accept this answer.</p>

<p>So, my question is that:</p>

<p>Should we check the format of connection string before creating SqlConnection object (as Veracode said)? If yes, how?</p>