ASP.NET

        public String DecryptMessage(byte[] encrypted)
        {
            ASCIIEncoding textConverter = new ASCIIEncoding();
            decryptor = aes.CreateDecryptor(key, IV);
            MemoryStream msDecrypt = new MemoryStream(encrypted);
            csEncrypt = new CryptoStream(msDecrypt, decryptor, CryptoStreamMode.Read);
            byte[] fromEncrypt = new byte[encrypted.Length];
            csEncrypt.Read(fromEncrypt, 0, fromEncrypt.Length);
            return textConverter.GetString(fromEncrypt);
        }
<pre>

I have run into an issue that when my web application's web.config compilation debug is set to true I am getting a vulnerability error on a security scan.

<compilation debug="true" targetFramework="4.0">

What I want to determine is if there is a way to have some type of web.config conditional block change the debug setting to use the correct value on debug builds and release builds. I have read that setting the property in each web page itself will do this and don't know if this is in fact true and are there any problems with this?

        public string GetAttributeKey(string attribute)
        {
            string qry = "SELECT ws_attribute_key FROM webservice_attributes WHERE ws_attribute = @attribute";

            QueryContainer Instance = new QueryContainer(qry);

            MyParam myParam = new MyParam();

            myParam.SqlParam = new SqlParameter("@attribute", Instance.AddParameterType(_DbTypes._string));

            myParam.SqlParam.Value = attribute;

            Instance.parameterList.Add(myParam);

            object key = ExecuteScaler(Instance);

            return Convert.ToString(key);
        }
<pre>

Scanner's Recommend fix:

<pre>
string user = ctx.getAuthenticatedUserName();
int16 id = System.Convert.ToInt16(invoiceID.Text);
SqlCommand query = new SqlCommand(
            "SELECT * FROM invoices WHERE id = <a href="http://www.codeproject.com/Members/id">@id</a> AND user = <a href="http://www.codeproject.com/Members/user">@user</a>", conn);
query.Parameters.AddWithValue("@id", id);
query.Parameters.AddWithValue("@user", user);
SqlDataReader objReader = query.ExecuteReader();
<pre>

<img src="http://www.domanin
name.co.uk/GetImage.aspx?filename=ImageName.png&width=200">

```

<script runat="server">
    Dim strServerPath, strFilename As String
    
    Private Sub Page_Load(sender As Object, e As System.EventArgs)
        Dim filename As String = Request.QueryString("filename")
        Dim width As Integer = Integer.Parse(Request.QueryString("width"))
        strServerPath = Server.MapPath("images\")
        strFilename = strServerPath & Request.QueryString("filename")
        
        Me.GenerateThumbnail(Server.MapPath(strFilename), width)
    End Sub

    Private Sub GenerateThumbnail(filename As String, width As Integer)
        Try
            Using orig As System.Drawing.Image = System.Drawing.Image.FromFile(filename)
                Me.GenerateThumbnail2(orig, New Size(width, CalculateHeight(orig, width)), GetFormat(filename))
            End Using
        Catch ex As Exception

        End Try
    End Sub

    Private Sub GenerateThumbnail2(orig As System.Drawing.Image, size As Size, format As ImageFormat)
        Try
            Using stream As New MemoryStream()
                Dim callback As New System.Drawing.Image.GetThumbnailImageAbort(AddressOf ThumbnailCallback)
                Dim img As System.Drawing.Image = orig.GetThumbnailImage(size.Width, size.Height, callback, IntPtr.Zero)
                img.Save(stream, format)
                Response.ContentType = "image/" + format.ToString()
                Response.BinaryWrite(stream.ToArray())
                'img.Save(Response.OutputStream, ImageFormat.Jpeg)
                img.Dispose()
                Response.Flush()

            End Using
            
        Catch ex As Exception
            Try
                Dim img As System.Drawing.Image = Drawing.Image.FromFile(strFilename)
                img.Save(Response.OutputStream, ImageFormat.Jpeg)
                
            Catch
                Dim img As System.Drawing.Image = Drawing.Image.FromFile(strServerPath & "PaddySheepskinSlippers1.png")
                img.Save(Response.OutputStream, ImageFormat.Jpeg)
                
            End Try
        End Try
        
    End Sub

    Private Shared Function GetFormat(filename As String) As ImageFormat
        If filename.EndsWith("jpg") OrElse filename.EndsWith("jpeg") OrElse filename.EndsWith("tiff") Then
            Return ImageFormat.Jpeg
        End If

        Return ImageFormat.Png
    End Function

    Private Shared Function CalculateHeight(img As System.Drawing.Image, desiredWidth As Double) As Integer
        Dim power As Double = img.Width / desiredWidth
        Return CInt(img.Height / power)
    End Function

    Private Function ThumbnailCallback() As Boolean
        Return False
    End Function
</script>

```