Skip to main content

Lack of data validation - Special Characters

Need​

Implementation of data validation to prevent the entry of special characters in fields

Context​

  • Usage of C# for developing robust and scalable applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications using the MVC architectural pattern
  • Usage of System for accessing and manipulating system-level resources and functionalities
  • Usage of System.Collections.Generic for working with generic collections in .NET
  • Usage of System.Linq for querying and manipulating data in C#
  • Usage of System.Threading.Tasks for asynchronous programming in .NET

Description​

Non compliant code​

using Microsoft.AspNetCore.Mvc;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace VulnerableApp.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class DataController : ControllerBase
    {
        [HttpPost]
        public ActionResult<string> Post([FromBody] string value)
        {
            // No validation is performed on the input value
            return "Data received: " + value;
        }
    }
}

In this code snippet, we have a simple ASP.NET Core controller that accepts HTTP POST requests on the route defined by the controller name, in this case /Data.

The Post method of the DataController accepts a string value from the request body. This value is directly used to create a response string which is returned to the client.

The vulnerability in this code is that there is no validation performed on the input value. This means that a user can input any string, including special characters, which could lead to various security issues such as Cross-Site Scripting (XSS) or SQL Injection, if the input value is used in a context where special characters have a significant meaning.

In the context of this code, the lack of validation does not directly lead to a security vulnerability, but it is a bad practice that could lead to vulnerabilities if this pattern is used in a more complex system where the input value is used in a security-sensitive context.

In general, it's a good practice to always validate and sanitize user input to ensure that it does not contain any data that could lead to security vulnerabilities. This includes checking for special characters that could be used in an attack.

Steps​

  • Implement input validation to ensure that special characters are not allowed in the input value.
  • Use regular expressions or built-in validation attributes to validate the input value.
  • Sanitize the input value by removing or escaping any special characters before processing or storing it.
  • Consider implementing a whitelist approach, where only specific characters or patterns are allowed in the input value.
  • Educate developers about the importance of input validation and the risks associated with allowing special characters.
  • Regularly review and update the input validation logic to account for new types of special characters or attack vectors.

Compliant code​

using Microsoft.AspNetCore.Mvc;
using System;
using System.ComponentModel.DataAnnotations;
using System.Text.RegularExpressions;
using System.Threading.Tasks;

namespace VulnerableApp.Controllers
{
    [ApiController]
    [Route("[controller]")]
    public class DataController : ControllerBase
    {
        [HttpPost]
        public ActionResult<string> Post([FromBody] ValidatedInput input)
        {
            // Input is now validated to not contain special characters
            return "Data received: " + input.Value;
        }
    }

    public class ValidatedInput
    {
        private string _value;

        [Required]
        public string Value
        {
            get { return _value; }
            set
            {
                if (Regex.IsMatch(value, @"^[a-zA-Z0-9]*$"))
                {
                    _value = value;
                }
                else
                {
                    throw new ArgumentException("Value contains invalid characters.");
                }
            }
        }
    }
}

The code above fixes the vulnerability by implementing input validation to ensure that special characters are not allowed in the input value. This is done by creating a new class ValidatedInput that encapsulates the input value and validates it using a regular expression in the setter of the Value property. The regular expression @"^[a-zA-Z0-9]*$" ensures that only alphanumeric characters are allowed in the input value.

The ValidatedInput class is then used as the parameter type for the Post method in the DataController class. This means that when a POST request is made to the DataController, the input value will be automatically validated by the ASP.NET Core framework using the validation logic in the ValidatedInput class. If the input value contains any special characters, an ArgumentException will be thrown, and the request will fail with a 400 Bad Request status code.

This approach effectively sanitizes the input value by rejecting any input that contains special characters. It is a form of whitelist validation, where only specific characters or patterns are allowed in the input value.

It is important for developers to understand the importance of input validation and the risks associated with allowing special characters in input values. Regular reviews and updates of the input validation logic are also necessary to account for new types of special characters or attack vectors.

References​

Last updated on