Security controls bypass or absence - Data creation

Need

Enforcement of security controls for data creation

Context

• Usage of Go 1.16 for building efficient and scalable applications
• Usage of Gin framework for building web applications in Go

Description

Non compliant code

package main

import (
	"github.com/gin-gonic/gin"
)

type Beneficiary struct {
	Name string `json:"name"`
}

type Policy struct {
	Beneficiaries []Beneficiary `json:"beneficiaries"`
}

func main() {
	r := gin.Default()

	r.POST("/policy", func(c *gin.Context) {
		var policy Policy
		if err := c.ShouldBindJSON(&policy); err != nil {
			c.JSON(400, gin.H{"error": err.Error()})
			return
		}

		// No restriction on the number of beneficiaries
		c.JSON(200, gin.H{"policy": policy})
	})

	r.Run()
}

In the code above, we are defining a Beneficiary struct and a Policy struct. A policy can have an array of beneficiaries.

We are using the Gin framework to create a POST endpoint at "/policy". This endpoint accepts a JSON body and binds it to the Policy struct.

The vulnerability here is that there is no restriction on the number of beneficiaries that can be added to a policy. An attacker can bypass the restriction that only allows the creation of four beneficiaries when generating a policy, allowing the generation of multiple beneficiaries associated to a request, affecting the integrity of the data sent.

This can lead to potential data integrity issues as the system is not designed to handle more than four beneficiaries per policy. It could also potentially lead to performance issues if a malicious user sends a request with a large number of beneficiaries.

Steps

• Implement a validation mechanism to limit the number of beneficiaries that can be created for a policy.
• Define a maximum limit for the number of beneficiaries allowed per policy.
• Check the number of beneficiaries received in the request and compare it with the defined limit.
• If the number of beneficiaries exceeds the limit, return an error response indicating that the maximum number of beneficiaries has been exceeded.
• Ensure that the validation mechanism is implemented before creating the policy to prevent the creation of policies with an excessive number of beneficiaries.

Compliant code

package main

import (
	"github.com/gin-gonic/gin"
)

type Beneficiary struct {
	Name string `json:"name"`
}

type Policy struct {
	Beneficiaries []Beneficiary `json:"beneficiaries"`
}

const MaxBeneficiaries = 4

func main() {
	r := gin.Default()

	r.POST("/policy", func(c *gin.Context) {
		var policy Policy
		if err := c.ShouldBindJSON(&policy); err != nil {
			c.JSON(400, gin.H{"error": err.Error()})
			return
		}

		// Check if the number of beneficiaries exceeds the limit
		if len(policy.Beneficiaries) > MaxBeneficiaries {
			c.JSON(400, gin.H{"error": "Maximum number of beneficiaries exceeded"})
			return
		}

		c.JSON(200, gin.H{"policy": policy})
	})

	r.Run()
}

The updated code now includes a validation mechanism to limit the number of beneficiaries that can be created for a policy.

A constant MaxBeneficiaries is defined to set the maximum limit for the number of beneficiaries allowed per policy.

In the POST request handler for "/policy", after binding the JSON request body to the policy struct, the code checks if the number of beneficiaries in the policy struct exceeds the MaxBeneficiaries limit.

If the number of beneficiaries exceeds the limit, the handler returns a 400 error response with a message indicating that the maximum number of beneficiaries has been exceeded.

This validation mechanism is implemented before the policy is created, preventing the creation of policies with an excessive number of beneficiaries and ensuring the integrity of the data sent.

References

• 305.Security controls bypass or absence - Data creation