Skip to main content

Lack of data validation - Emails

Need​

Implementation of email validation to prevent registration with disposable email addresses

Context​

  • Usage of Java 8 for developing applications with enhanced features and performance
  • Usage of javax.servlet-api for Java Servlet development

Description​

Non compliant code​

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class RegistrationServlet extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String email = request.getParameter("email");
        // Register the user with the provided email
        registerUser(email);
    }

    private void registerUser(String email) {
        // Code to register the user
    }
}

The above code represents a servlet that handles user registration in a Java web application using the javax.servlet package.

The doPost method is called when a POST request is sent to the server. It retrieves the email parameter from the request, which is expected to be provided by the user during the registration process. This email is then passed to the registerUser method, which would typically handle the actual registration process such as storing the user's details in a database.

The vulnerability lies in the fact that there is no validation performed on the email parameter before it is used to register the user. This means that a user can provide any email address, including those from disposable mailboxes such as yopmail, and the system will accept it. This can lead to a variety of issues such as spamming, abuse of system resources, and difficulties in user management and communication.

To mitigate this vulnerability, the system should implement a validation step before registering the user to ensure that the provided email address is not from a disposable mailbox. This could involve checking the email domain against a list of known disposable email services, or using a third-party service that provides this validation.

Steps​

  • Implement server-side email validation to check if the email belongs to a disposable mailbox.
  • Use a reliable email validation library or API to validate the email address.
  • Consider implementing additional validation checks such as checking for valid email format and domain existence.
  • Inform the user if the provided email is not valid and prompt them to provide a valid email address.
  • Consider implementing rate limiting or CAPTCHA to prevent abuse of the registration process.
  • Regularly update the email validation mechanism to stay up-to-date with new disposable email services.

Compliant code​

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.apache.commons.validator.routines.EmailValidator;

public class RegistrationServlet extends HttpServlet {
    public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        String email = request.getParameter("email");
        // Validate the email before registering the user
        if (isValidEmail(email)) {
            registerUser(email);
        } else {
            // Inform the user that the provided email is not valid
            response.sendError(HttpServletResponse.SC_BAD_REQUEST, "Invalid email address. Please provide a valid email.");
        }
    }

    private void registerUser(String email) {
        // Code to register the user
    }

    private boolean isValidEmail(String email) {
        // Use Apache Commons Validator to validate the email
        EmailValidator validator = EmailValidator.getInstance();
        if (!validator.isValid(email)) {
            return false;
        }

        // Check if the email belongs to a disposable mailbox
        String domain = email.substring(email.indexOf('@') + 1);
        // List of disposable email domains. This should be regularly updated.
        List<String> disposableEmailDomains = Arrays.asList("yopmail.com", "mailinator.com", "10minutemail.com");
        if (disposableEmailDomains.contains(domain)) {
            return false;
        }

        return true;
    }
}

The updated code includes a method isValidEmail that validates the email address before registering the user. This method uses the Apache Commons Validator library to check if the email is in a valid format.

After validating the format, the method checks if the email belongs to a disposable mailbox. It does this by extracting the domain from the email and checking if it is in a list of known disposable email domains. If the email is either not in a valid format or belongs to a disposable mailbox, the method returns false.

In the doPost method, the application now checks if the email is valid before registering the user. If the email is not valid, it sends an error response to the user asking them to provide a valid email.

This solution helps prevent users from registering with disposable email addresses. However, it is important to regularly update the list of disposable email domains to stay up-to-date with new disposable email services.

Additionally, consider implementing rate limiting or CAPTCHA to prevent abuse of the registration process.

References​

Last updated on