Skip to main content

Lack of data validation - Headers

Need​

Implementation of proper data validation for HTTP headers

Context​

  • Usage of C# for building robust and scalable applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core

Description​

Non compliant code​

[HttpGet]
public IActionResult Get()
{
    string headerValue = Request.Headers["CustomHeader"];

    // ... rest of the code
}

In the above code, the HTTP header "CustomHeader" is being accessed directly without any form of validation. This means that an attacker could potentially inject malicious values into this header.

For instance, if the value of this header is used in a context that is vulnerable to Cross-Site Scripting (XSS), an attacker could inject a script as the header's value. When this script is subsequently used in a web page, it would be executed in the context of the victim's browser, potentially leading to session hijacking, identity theft, or other forms of attack.

Furthermore, if the value of this header is used in a database query, an attacker could potentially inject SQL commands, leading to SQL Injection attacks. This could allow the attacker to view, modify, or delete data in the database.

The lack of validation also compromises the integrity of the stored information. If the header's value is stored in the database or used in any other form of data processing, the lack of validation could lead to the storage and processing of incorrect or malicious data.

Steps​

  • Implement input validation for the 'CustomHeader' value.
  • Use a whitelist approach to only allow specific values for the 'CustomHeader' header.
  • Sanitize the input by removing any potentially harmful characters or scripts.
  • Consider using a library or framework that provides built-in validation and sanitization mechanisms.
  • Regularly update and patch the application and its dependencies to ensure the latest security fixes are applied.

Compliant code​

[HttpGet]
public IActionResult Get()
{
    string headerValue = Request.Headers["CustomHeader"];

    // Validate the header value
    if (!IsValidHeaderValue(headerValue))
    {
        return BadRequest("Invalid header value");
    }

    // ... rest of the code
}

private bool IsValidHeaderValue(string headerValue)
{
    // Define a list of valid header values
    var validHeaderValues = new List<string> { "value1", "value2", "value3" };

    // Check if the header value is in the list of valid values
    if (!validHeaderValues.Contains(headerValue))
    {
        return false;
    }

    // Sanitize the header value
    headerValue = System.Net.WebUtility.HtmlEncode(headerValue);

    return true;
}

The updated code includes a method IsValidHeaderValue that validates the value of the 'CustomHeader' header. This method uses a whitelist approach, where only specific values are allowed for the 'CustomHeader' header. This list of valid values is defined in the validHeaderValues list.

If the header value is not in the list of valid values, the method returns false, indicating that the header value is not valid.

The header value is also sanitized using the HtmlEncode method from the System.Net.WebUtility class. This method encodes the string to be used safely in an HTML context, effectively removing any potentially harmful characters or scripts.

If the header value is not valid, the Get method returns a bad request response with a message indicating that the header value is invalid. This prevents the rest of the code from executing with an invalid or potentially harmful header value.

Remember to regularly update and patch your application and its dependencies to ensure the latest security fixes are applied. Consider using a library or framework that provides built-in validation and sanitization mechanisms for a more robust solution.

References​

Last updated on