Skip to main content

Lack of data validation - Responses

Need​

Implementation of robust data validation for response data

Context​

  • Usage of Dart 2.0 for building high-performance, cross-platform applications
  • Usage of Shelf for managing and organizing data in a Node.js application

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

shelf.Response handleRequest(shelf.Request request) {
  // Get data from the request
  var requestData = request.readAsString();

  // Use the data in a subsequent request without any validation
  var subsequentRequest = shelf.Request('POST', Uri.parse('http://localhost:8080'), body: requestData);

  // Handle the subsequent request
  return handleSubsequentRequest(subsequentRequest);
}

shelf.Response handleSubsequentRequest(shelf.Request request) {
  // Process the request and return a response
  var responseData = request.readAsString();
  return shelf.Response.ok(responseData);
}

In the above code, we have two functions handleRequest and handleSubsequentRequest. The handleRequest function reads the data from the incoming request and uses this data to create a subsequent request. However, there is no validation being done on the data being read from the initial request. This means that if the initial request contains invalid data, this invalid data will be used in the subsequent request.

The handleSubsequentRequest function then processes this subsequent request and returns a response. Again, there is no validation being done on the data being used in the response. This means that if the subsequent request contains invalid data, this invalid data will be included in the response.

This lack of data validation poses a security risk as it allows for potential data corruption and manipulation. It can lead to unexpected behavior in the application and can potentially expose sensitive information. It's also a common vector for attacks such as SQL Injection and Cross-Site Scripting (XSS).

Steps​

  • Introduce a data validation layer before using the response data in subsequent requests. This can be done by creating a function that checks the data for any inconsistencies or errors.
  • Ensure that the validation function checks for all possible types of invalid data. This could include checking for null values, incorrect data types, or values that are outside of the expected range.
  • If the validation function detects invalid data, it should throw an error or return a response indicating that the data is invalid. This prevents the invalid data from being used in subsequent requests.
  • Call the validation function before using the response data in subsequent requests. If the validation function throws an error or returns an invalid response, the subsequent request should not be made.
  • Test the validation function with various types of invalid data to ensure that it correctly identifies all invalid data and prevents it from being used in subsequent requests.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;

// Function to validate data
bool validateData(String data) {
  // Add your validation logic here
  // For example, check if the data is null or empty
  if (data == null || data.isEmpty) {
    return false;
  }

  // Check for other types of invalid data...

  // If all checks pass, the data is valid
  return true;
}

shelf.Response handleRequest(shelf.Request request) {
  // Get data from the request
  var requestData = request.readAsString();

  // Validate the data
  if (!validateData(requestData)) {
    // If the data is invalid, return an error response
    return shelf.Response(400, body: 'Invalid data');
  }

  // Use the data in a subsequent request
  var subsequentRequest = shelf.Request('POST', Uri.parse('http://localhost:8080'), body: requestData);

  // Handle the subsequent request
  return handleSubsequentRequest(subsequentRequest);
}

shelf.Response handleSubsequentRequest(shelf.Request request) {
  // Process the request and return a response
  var responseData = request.readAsString();
  return shelf.Response.ok(responseData);
}

The updated code introduces a data validation layer before using the response data in subsequent requests. This is done by creating a function validateData that checks the data for any inconsistencies or errors.

The validateData function checks for all possible types of invalid data. In this example, it checks if the data is null or empty. You should add additional checks for your specific use case, such as checking for incorrect data types, or values that are outside of the expected range.

If the validateData function detects invalid data, it returns false. In the handleRequest function, if validateData returns false, an error response is returned with a 400 status code and a message indicating that the data is invalid. This prevents the invalid data from being used in subsequent requests.

The validateData function is called before using the response data in subsequent requests. If the validation function returns false, the subsequent request is not made.

You should test the validateData function with various types of invalid data to ensure that it correctly identifies all invalid data and prevents it from being used in subsequent requests.

References​

Last updated on