Skip to main content

Lack of data validation - Special Characters

Need​

Implementation of proper data validation to prevent the entry of special characters in fields.

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;

shelf.Response handleRequest(shelf.Request request) {
  var params = request.url.queryParameters;
  var name = params['name'];

  // Process name without validating special characters

  return shelf.Response.ok('Hello, $name!');
}

In the above Dart code, we are using the Shelf framework to handle HTTP requests. Specifically, we're looking at a function handleRequest that takes a shelf.Request as an argument and returns a shelf.Response.

The vulnerability lies in the following lines:

var params = request.url.queryParameters;
var name = params['name'];

Here, we're extracting query parameters from the URL of the request. We then directly use the 'name' parameter from the request without any validation. This means if a client sends a request with special characters in the 'name' parameter, our system will accept it and proceed with the processing, which could lead to unexpected behavior or security vulnerabilities such as Cross-Site Scripting (XSS) or SQL Injection.

For instance, a user could send a request with a name parameter like John<script>alert('Hacked')</script>, and our system would accept this input and potentially execute the embedded script when the response is rendered in a web page.

To fix this vulnerability, we need to validate the 'name' parameter to ensure it does not contain any special characters before using it.

Steps​

  • Introduce a validation function that checks for special characters in the 'name' parameter.
  • Use this function to validate the 'name' parameter before processing it.
  • If the validation function detects special characters, the function should handle it appropriately, for example by returning an error message or sanitizing the input.
  • Ensure that the validation function is used every time the 'name' parameter is processed, to maintain consistency and security.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;

bool isValid(String input) {
  // Check if the string contains any special characters
  return RegExp(r'^[a-zA-Z0-9]+$').hasMatch(input);
}

shelf.Response handleRequest(shelf.Request request) {
  var params = request.url.queryParameters;
  var name = params['name'];

  // Validate name before processing
  if (!isValid(name)) {
    return shelf.Response(400, body: 'Invalid input: name should not contain special characters');
  }

  return shelf.Response.ok('Hello, $name!');
}

The updated code includes a new function isValid that checks if a string contains any special characters. This function uses a regular expression to check if the string only contains alphanumeric characters (letters and numbers). If the string contains any special characters, the function returns false.

In the handleRequest function, we now call isValid to validate the 'name' parameter before processing it. If isValid returns false, the function immediately returns a response with a 400 status code and an error message indicating that the input is invalid. This prevents the rest of the function from processing the invalid input.

This change ensures that the system validates all input for special characters before processing it, which can help prevent various types of attacks, such as SQL injection or cross-site scripting (XSS). It's important to always validate input on the server side, even if you also do client-side validation, because attackers can easily bypass client-side validation.

References​

Last updated on