Skip to main content

Insufficient data authenticity validation

Need​

Enhancement of data authenticity validation

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application
  • Usage of shelf_io for managing and interacting with data storage in Node.js

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main(List<String> args) async {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  var server = await io.serve(handler, 'localhost', 8080);

  print('Serving at http://${server.address.host}:${server.port}');
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}

The above code is a simple server setup using the Dart Shelf framework. The _echoRequest function is used to handle incoming requests. However, it doesn't check if the provided data is valid or if the user has the right to modify certain fields.

This means that if a user sends a request with invalid data, such as a non-existing name, the server will still accept it. This can lead to various issues, including data corruption, unexpected behavior, and security vulnerabilities.

In this case, the vulnerability lies in the lack of validation for the incoming data. The server should not blindly accept all incoming data. Instead, it should verify that the data is valid and that the user has the right to modify the data. This is known as data authenticity validation.

Without sufficient data authenticity validation, the application is vulnerable to attacks where an attacker can send invalid or malicious data to the server. This can lead to a variety of security issues, including unauthorized access, data corruption, and data leakage.

Steps​

  • Implement an authentication and authorization mechanism to ensure that only authorized users can modify certain fields.
  • Validate the data received from the client side. Check for the existence of names before allowing them to be used.
  • Use server-side validation to ensure that the data is in the correct format and meets the necessary criteria before it is processed.
  • Consider using a library or framework that provides built-in protections against common vulnerabilities.
  • Regularly update and patch your server and its dependencies to protect against known vulnerabilities.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;
import 'package:shelf_auth/shelf_auth.dart';
import 'dart:convert';

void main(List<String> args) async {
  var handler = const shelf.Pipeline()
      .addMiddleware(shelf.logRequests())
      .addMiddleware(authenticate([new JwtAuthMiddleware('your_secret_key')]))
      .addHandler(_echoRequest);

  var server = await io.serve(handler, 'localhost', 8080);

  print('Serving at http://${server.address.host}:${server.port}');
}

shelf.Response _echoRequest(shelf.Request request) {
  var data = jsonDecode(request.readAsString());
  if (data['name'] == null || data['name'] == '') {
    return shelf.Response(400, body: 'Invalid data');
  }
  // Add your logic to check if the name exists in your database
  return shelf.Response.ok('Request for "${request.url}"');
}

The updated code now includes an authentication middleware that uses JWT (JSON Web Tokens) for authentication. This ensures that only authenticated users can make requests to the server. The shelf_auth package is used to provide this functionality.

In the _echoRequest function, the request data is now parsed and validated. If the 'name' field is null or empty, a 400 response is returned indicating that the client has sent invalid data.

Please replace 'your_secret_key' with your actual secret key for JWT.

This is a basic example and in a real-world application, you would need to implement more comprehensive data validation and error handling. You would also need to check if the name exists in your database before processing the request.

Remember to regularly update and patch your server and its dependencies to protect against known vulnerabilities.

References​

Last updated on