Skip to main content

Data uniqueness not properly verified

Need​

Enforcement of data uniqueness verification

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Illuminate\Http\Request for handling HTTP requests in Laravel
  • Usage of the User module in the App namespace

Description​

Non compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use App\\User;

class UserController extends Controller
{
    public function store(Request $request)
    {
        $user = new User();

        $user->email = $request->email;
        $user->password = bcrypt($request->password);

        $user->save();

        return response()->json(['message' => 'User created successfully'], 201);
    }
}

In the above code, we are creating a new user in the store method of the UserController. The user's email and password are being taken directly from the request and the password is being hashed using Laravel's bcrypt function.

The vulnerability lies in the fact that we are not checking if a user with the same email already exists in our database. This means that if an attacker knows the email of a user, they can create a new account with the same email. This could lead to serious security issues, as the email is often used as a unique identifier for a user. This could allow an attacker to impersonate another user, or to create multiple accounts with the same email, leading to confusion and potential data integrity issues.

Steps​

  • Before saving the user data, check if a user with the same email already exists in the database.
  • If a user with the same email exists, return an error message indicating that the email is already in use.
  • Only proceed with saving the user data if the email is unique.

Compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use App\\User;

class UserController extends Controller
{
    public function store(Request $request)
    {
        // Check if the email already exists in the database
        $existingUser = User::where('email', $request->email)->first();

        // If a user with the same email exists, return an error message
        if ($existingUser) {
            return response()->json(['message' => 'Email already in use'], 400);
        }

        // Create a new user
        $user = new User();

        $user->email = $request->email;
        $user->password = bcrypt($request->password);

        $user->save();

        return response()->json(['message' => 'User created successfully'], 201);
    }
}

The updated code now includes a check for existing users with the same email before proceeding to create a new user.

The User::where('email', $request->email)->first(); line checks the database for a user with the same email as the one provided in the request. If a user with the same email is found ($existingUser is not null), the function returns a JSON response with a 400 status code and an error message indicating that the email is already in use.

If no user with the same email is found ($existingUser is null), the function proceeds to create a new user with the provided email and password, save the user to the database, and return a JSON response with a 201 status code and a success message.

This update ensures that each user's email is unique, preventing an attacker from reusing or regenerating information that should be valid for one use only.

References​

Last updated on