Skip to main content

Lack of data validation - HTML code

Need​

Implementation of proper data validation and sanitization for HTML code input

Context​

  • Usage of C# for developing robust and efficient applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications using the ASP.NET Core MVC framework
  • Usage of Newtonsoft.Json for JSON serialization and deserialization

Description​

Non compliant code​

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Newtonsoft.Json;

namespace VulnerableApp.Controllers
{
    [Route("api/[controller]")]
    public class ValuesController : Controller
    {
        // GET api/values
        [HttpGet]
        public string Get()
        {
            var data = new { HTMLContent = "<script>alert('This is a test');</script>" };
            return JsonConvert.SerializeObject(data);
        }
    }
}

The above code represents a controller in an ASP.NET Core application that lacks data validation, specifically for HTML content. This can lead to a potential HTML Injection vulnerability.

In the Get method, a new object data is created with a property HTMLContent that contains a string with an HTML script tag. This string is then serialized into a JSON string using JsonConvert.SerializeObject(data). The resulting JSON string is then returned as the HTTP response.

The problem here is that the application does not validate or sanitize the HTML content before sending it as a response. This means that if the client-side application that consumes this API interprets the HTML content in the JSON response, it could potentially execute the script tag in the HTML content.

This can lead to various security issues, such as Cross-site Scripting (XSS) attacks where attackers can inject malicious scripts that can be executed on the client-side, potentially leading to data theft, session hijacking, or other malicious activities.

Steps​

  • Implement input validation to sanitize user input.
  • Use appropriate encoding or escaping techniques to prevent HTML code injection.
  • Avoid returning raw HTML code in JSON responses.
  • Consider using a content security policy to restrict the execution of scripts.
  • Regularly update and patch the ASP.NET Core framework to benefit from security fixes.

Compliant code​

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Newtonsoft.Json;
using System.Text.Encodings.Web;

namespace VulnerableApp.Controllers
{
    [Route("api/[controller]")]
    public class ValuesController : Controller
    {
        // GET api/values
        [HttpGet]
        public string Get()
        {
            var data = new { HTMLContent = "<script>alert('This is a test');</script>" };
            var encodedData = new { HTMLContent = HtmlEncoder.Default.Encode(data.HTMLContent) };
            return JsonConvert.SerializeObject(encodedData);
        }
    }
}

The original code was vulnerable to HTML code injection because it did not sanitize or encode the HTML content before returning it in a JSON response. This could allow an attacker to inject malicious scripts into the HTML content, which would then be executed when the JSON response is processed.

The fixed code mitigates this vulnerability by using the HtmlEncoder.Default.Encode method from the System.Text.Encodings.Web namespace to encode the HTML content before returning it. This method replaces HTML-specific characters with their corresponding HTML entities, effectively preventing any injected scripts from being executed.

In addition to this, it's recommended to avoid returning raw HTML code in JSON responses whenever possible, as this can make the application more susceptible to HTML code injection attacks. Instead, consider returning data in a format that does not require HTML encoding, such as plain text or JSON.

Finally, it's important to regularly update and patch the ASP.NET Core framework to benefit from security fixes. This can help protect the application against known vulnerabilities and exploits.

References​

Last updated on