Skip to main content

Lack of data validation

Need​

Implementation of robust data validation mechanisms

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application
  • Usage of shelf_router for routing and request handling in a Shelf application

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf_router/shelf_router.dart';

class Controller {
  final Router _router = Router();

  Controller() {
    _router.post('/update', _updateData);
  }

  shelf.Handler get router => _router;

  shelf.Response _updateData(shelf.Request request) {
    // Extracting data from request without validation
    final id = request.headers['id'];
    final data = request.headers['data'];

    // Simulating database update
    print('Updating data with ID: $id');
    print('New data: $data');

    return shelf.Response.ok('Data updated');
  }
}

The above code represents a server-side controller of a Dart backend application using the Shelf framework. The controller has a POST route /update which is used to update data.

The vulnerability here is the lack of data validation. The _updateData function extracts the id and data from the request headers without validating them. This means that the application could potentially allow the use of invalid data, such as an ID composed of only letters, which might not be a valid format for the database. This could lead to various issues such as data corruption or unexpected behavior of the application.

In a real-world scenario, the data extracted from the request would be used to update records in the database. Without proper validation, this could lead to SQL injection attacks if the data is used in a SQL query without sanitizing it, or it could simply lead to invalid data being stored in the database.

The application should always validate the data before using it, especially when the data is coming from an external source such as a client request. The validation should ensure that the data is in the correct format and within the expected range of values.

Steps​

  • Introduce data validation for the 'id' and 'data' fields. This could be done using regular expressions or built-in validation functions.
  • For the 'id' field, ensure that it only contains valid characters (e.g., numbers). Reject any request where the 'id' is not valid.
  • For the 'data' field, define what constitutes valid data and reject any request where the 'data' does not meet these criteria.
  • Consider using a library or framework that provides built-in validation features to simplify this process.
  • Ensure that the validation is performed on the server side, not just on the client side, to prevent malicious users from bypassing the validation.
  • After implementing the validation, test it thoroughly to ensure that it correctly rejects invalid data and accepts valid data.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf_router/shelf_router.dart';

class Controller {
  final Router _router = Router();

  Controller() {
    _router.post('/update', _updateData);
  }

  shelf.Handler get router => _router;

  shelf.Response _updateData(shelf.Request request) {
    // Extracting data from request
    final id = request.headers['id'];
    final data = request.headers['data'];

    // Validate ID
    final idRegex = RegExp(r'^\\d+$');
    if (!idRegex.hasMatch(id)) {
      return shelf.Response(400, body: 'Invalid ID');
    }

    // Validate data
    // Assuming data should be alphanumeric
    final dataRegex = RegExp(r'^[a-zA-Z0-9]+$');
    if (!dataRegex.hasMatch(data)) {
      return shelf.Response(400, body: 'Invalid data');
    }

    // Simulating database update
    print('Updating data with ID: $id');
    print('New data: $data');

    return shelf.Response.ok('Data updated');
  }
}

The updated code now includes data validation for the 'id' and 'data' fields.

For the 'id' field, a regular expression is used to ensure that it only contains numbers. If the 'id' does not match this pattern, the server responds with a 400 status code and a message indicating that the 'id' is invalid.

For the 'data' field, another regular expression is used to ensure that it only contains alphanumeric characters. If the 'data' does not match this pattern, the server responds with a 400 status code and a message indicating that the 'data' is invalid.

This validation is performed on the server side, which prevents malicious users from bypassing the validation by modifying the client-side code.

After implementing this validation, it is important to test it thoroughly to ensure that it correctly rejects invalid data and accepts valid data. This can be done by sending requests with various combinations of valid and invalid 'id' and 'data' values and verifying that the server responds appropriately.

References​

Last updated on