Skip to main content

Lack of data validation - Headers

Need​

Implementation of proper data validation for HTTP headers

Context​

  • Usage of Go 1.16 for building efficient and scalable applications
  • Usage of gin-gonic/gin for building web applications in Go

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
)

func main() {
	r := gin.Default()

	r.GET("/header", func(c *gin.Context) {
		header := c.GetHeader("X-Custom-Header")

		c.JSON(200, gin.H{
			"header": header,
		})
	})

	r.Run() 
}

The above code is a simple HTTP server written in Go using the Gin framework. The server has a single endpoint, /header, which reads the value of the X-Custom-Header from the incoming HTTP request and returns it in the response without any validation.

This is a potential security vulnerability as it allows for HTTP Header Injection attacks. An attacker could exploit this by sending a request with a malicious value in the X-Custom-Header. This could lead to various attacks such as Cross-Site Scripting (XSS), where the attacker injects malicious scripts in the header that are executed in the user's browser.

The vulnerability lies in this line of code:

header := c.GetHeader("X-Custom-Header")

Here, the header's value is directly obtained from the HTTP request without any validation or sanitization. This means that any value, including potentially harmful ones, can be included in the response.

Steps​

  • Implement input validation for the 'X-Custom-Header' header.
  • Define a whitelist of allowed values for the 'X-Custom-Header' header.
  • Reject requests with invalid or unexpected values for the 'X-Custom-Header' header.
  • Sanitize the input by removing any potentially harmful characters or scripts.
  • Consider using a library or framework that provides built-in validation and sanitization mechanisms for headers.

Compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
	"strings"
)

func main() {
	r := gin.Default()

	r.GET("/header", func(c *gin.Context) {
		header := c.GetHeader("X-Custom-Header")

		// Define a whitelist of allowed values
		allowedValues := []string{"value1", "value2", "value3"}

		// Check if the header value is in the whitelist
		isValid := false
		for _, v := range allowedValues {
			if strings.EqualFold(v, header) {
				isValid = true
				break
			}
		}

		// If the header value is not valid, reject the request
		if !isValid {
			c.JSON(http.StatusBadRequest, gin.H{
				"message": "Invalid header value",
			})
			return
		}

		c.JSON(200, gin.H{
			"header": header,
		})
	})

	r.Run() 
}

The updated code now includes a validation step for the 'X-Custom-Header' header. This is done by defining a whitelist of allowed values for the header and checking if the received header value is in this whitelist. If the header value is not in the whitelist, the request is rejected with a 400 Bad Request status code.

This validation step helps to prevent potential XSS attacks or compromises to the integrity of the stored information by ensuring that only expected and safe values are accepted in the 'X-Custom-Header' header.

Please note that the allowed values in the whitelist are just placeholders ('value1', 'value2', 'value3'). You should replace them with the actual values that you expect in the 'X-Custom-Header' header.

Also, this code uses the strings.EqualFold function to perform a case-insensitive comparison of the header value and the allowed values. This is to ensure that the validation is not bypassed by simply changing the case of the header value.

Finally, remember to always sanitize the input by removing any potentially harmful characters or scripts. This can be done using a library or framework that provides built-in validation and sanitization mechanisms for headers.

References​

Last updated on