Skip to main content

Lack of data validation - Special Characters

Need​

Implementation of data validation to prevent the use of special characters in input fields.

Context​

  • Usage of Go 1.16 for developing scalable and efficient applications
  • Usage of gin-gonic/gin for building web applications in Go

Description​

Non compliant code​

package main

import (
	"github.com/gin-gonic/gin"
)

func main() {
	r := gin.Default()

	r.POST("/submit", func(c *gin.Context) {
		var json struct {
			Value string `json:"value" binding:"required"`
		}

		if err := c.ShouldBindJSON(&json); err == nil {
			c.JSON(200, gin.H{"status": "you are logged in"})
		} else {
			c.JSON(400, gin.H{"status": "input field is required"})
		}
	})

	r.Run()
}

In the provided Go code, we have an HTTP server that uses the Gin framework. The server has one route, "/submit", which accepts POST requests.

The route handler function attempts to bind the incoming JSON request body to a struct. The struct has a single field, Value, which is a string and is required. If the binding is successful, it returns a 200 status code along with a message. If the binding fails, perhaps due to the absence of the Value field in the request body, it returns a 400 status code with a different message.

The vulnerability lies in the fact that there is no validation for the Value field in the struct. This means that a user can enter any string, including ones with special characters. This lack of validation can lead to a variety of security issues such as SQL Injection, Cross-Site Scripting (XSS), and Command Injection.

Steps​

  • Implement data validation on the server-side to ensure that special characters are not allowed in the input field.
  • Use a regular expression or a validation library to check for the presence of special characters.
  • Reject the request and return an appropriate error message if special characters are found in the input field.
  • Consider implementing client-side validation as an additional layer of defense to prevent users from entering special characters in the first place.

Compliant code​

package main

import (
	"github.com/gin-gonic/gin"
	"net/http"
	"regexp"
)

func main() {
	r := gin.Default()

	r.POST("/submit", func(c *gin.Context) {
		var json struct {
			Value string `json:"value" binding:"required"`
		}

		if err := c.ShouldBindJSON(&json); err == nil {
			match, _ := regexp.MatchString("^[a-zA-Z0-9]*$", json.Value)
			if match {
				c.JSON(http.StatusOK, gin.H{"status": "you are logged in"})
			} else {
				c.JSON(http.StatusBadRequest, gin.H{"status": "special characters are not allowed"})
			}
		} else {
			c.JSON(http.StatusBadRequest, gin.H{"status": "input field is required"})
		}
	})

	r.Run()
}

The updated code includes a regular expression check to validate the input data. The regular expression ^[a-zA-Z0-9]*$ ensures that only alphanumeric characters are allowed. If the input data contains any special characters, the match will fail and an error message will be returned to the client.

The regexp.MatchString function is used to apply the regular expression to the input data. If the input data matches the regular expression (i.e., it contains only alphanumeric characters), the function will return true. Otherwise, it will return false.

If the input data is valid, the server will return a 200 status code along with a success message. If the input data is invalid (either because it contains special characters or because it is missing), the server will return a 400 status code along with an appropriate error message.

This server-side validation ensures that special characters are not allowed in the input field, thereby mitigating the risk of injection attacks. However, it is also recommended to implement client-side validation as an additional layer of defense.

References​

Last updated on