I have done the following...

```
private static IDbConnectionProvider CreateSqlConnectionProvider(DbConfig dbConfig)
{
    return new QcDbConnectionProvider(() =>
        {
            SqlConnectionStringBuilder csBuilder = new SqlConnectionStringBuilder();

            if (!string.IsNullOrEmpty(dbConfig.DataSource)) 
                csBuilder.DataSource = dbConfig.DataSource;

            if (!string.IsNullOrEmpty(dbConfig.Database))
                csBuilder.InitialCatalog = dbConfig.Database;

            .
            .
            .
            .

            return new SqlConnection(csBuilder.ConnectionString);
        });
}

```

The client is using VERACODE tool for doing code analysis and the VERACODE has detected a flaw "Untrusted initialization" at 

```
return new SqlConnection(csBuilder.ConnectionString);

```

Also, the `dbConfig` is being initialized as shown below...

```
DbConfig configDbConfig = new DbConfig
{
    Database = codeFile.ConfigurationDb,
    DataSource = codeFile.DataSource,
    IntegratedSecurity = sqlCredentials.UseWindowsAuthentication ? 1 : 0,
    UserId = sqlCredentials.UseWindowsAuthentication ? null : sqlCredentials.SqlUserName,
    ClearTextPassword = sqlCredentials.UseWindowsAuthentication ? null : sqlCredentials.SqlUserPassword
};

```

What else I need to do in order to fix this flaw? Also as per [this link](https://www.defcon.org/images/defcon-18/dc-18-presentations/Alonso-Palazon/DEFCON-18-Alonso-Palazon-String-wp.pdf), I am creating the connection string using the `SqlConnectionStringBuilder` which is safe of creating the connection string.

Thanks in advance...