Skip to main content

Lack of data validation - URL

Need​

Implementation of robust data validation for URL parameters

Context​

  • Usage of Dart 2.0 for building high-performance, cross-platform applications
  • Usage of Shelf for managing data storage and retrieval

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

shelf.Response handleRequest(shelf.Request request) {
    var date = request.requestedUri.queryParameters['date'];
    var documents = getDocumentsByDate(date);
    return shelf.Response.ok(documents);
}

List getDocumentsByDate(String date) {
    // fetch documents from database
    return [];
}

The above code is vulnerable to data exposure through URL manipulation. The function handleRequest(shelf.Request request) is used to handle incoming requests from users. It retrieves the 'date' parameter from the URL query parameters without any form of validation. This date is then passed to the getDocumentsByDate(String date) function, which fetches and returns all documents sent on the specified date.

This vulnerability implies that any user can manipulate the URL by changing the 'date' parameter to any date of their choice, thereby gaining access to all documents sent on that date. This exposes sensitive user information and documents to unauthorized access and potential data theft.

To prevent this, it is essential to add data validation checks to ensure that only authorized users can view documents for specific dates.

Steps​

  • Validate the 'date' parameter to ensure it's in the correct format and within a reasonable range before using it in the 'getDocumentsByDate' function.
  • Implement an authentication mechanism to ensure that only authorized users can access the documents.
  • Use an authorization mechanism to ensure that users can only access documents that they are allowed to see.
  • Consider using a rate limiting mechanism to prevent brute force attacks where an attacker might try to guess the 'date' parameter.
  • Encrypt sensitive data in transit and at rest to protect it from being intercepted or accessed if the database is compromised.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf_auth/shelf_auth.dart';
import 'package:intl/intl.dart';

shelf.Response handleRequest(shelf.Request request) {
  var date = request.requestedUri.queryParameters['date'];
  
  // Validate date
  if (!isValidDate(date)) {
    return shelf.Response.forbidden('Invalid date format');
  }

  // Check if user is authenticated
  if (!isAuthenticated(request)) {
    return shelf.Response.forbidden('You are not authorized to access this resource');
  }

  var documents = getDocumentsByDate(date);
  return shelf.Response.ok(documents);
}

bool isValidDate(String date) {
  try {
    DateFormat('yyyy-MM-dd').parseStrict(date);
    return true;
  } catch (e) {
    return false;
  }
}

bool isAuthenticated(shelf.Request request) {
  // Implement your authentication logic here
  return false;
}

List getDocumentsByDate(String date) {
  // fetch documents from database
  return [];
}

The updated code includes a function isValidDate to validate the date format. It uses the DateFormat class from the intl package to parse the date string. If the date string is not in the 'yyyy-MM-dd' format, the parseStrict method will throw an exception, and the isValidDate function will return false.

The handleRequest function now checks if the date is valid before proceeding. If the date is not valid, it returns a 403 Forbidden response.

The code also includes a function isAuthenticated to check if the user is authenticated. This function should contain your authentication logic. The handleRequest function checks if the user is authenticated before proceeding. If the user is not authenticated, it returns a 403 Forbidden response.

The getDocumentsByDate function should also include authorization checks to ensure that the user is allowed to access the requested documents.

For rate limiting and data encryption, you would need to implement these at a higher level in your application or infrastructure. These are not typically implemented at the level of individual request handlers.

References​

Last updated on