webclient - Veracode fails with the following error: Insertion of Sensitive Information Into Sent Data when using AppSettings

Question

I have the following logic for a WebClient:

var wc = new WebClient();

wc.QueryString.Add("ID", id);
wc.QueryString.Add("fyear", $"{y}");
wc.QueryString.Add("fmonth", $"{m}");
wc.QueryString.Add("fday", $"{d}");
wc.QueryString.Add("SType", $"{tID}");


wc.UseDefaultCredentials = true;

sPdf = wc.DownloadData(Configuration.GetURLString);

The line the scan is pointing out to is: sPdf = wc.DownloadData(Configuration.GetURLString);

GetURLString is defined as following:

public static string GetURLString
            => ConfigurationManager.AppSettings["GenURLString"] ?? "";

I made a change to sPdf = wc.DownloadData(new Uri(Configuration.GetURLString)); but it failed in the run time, so the change was rolled back.

What is another way to mitigate that issue?

标签： webclientappsettingsveracode