Skip to main content

Improper type assignation

Need​

Enforce proper type assignation in the source code

Context​

  • Usage of PHP for server-side scripting and web development

Description​

Non compliant code​

function process($data) {
    $result = $data;
    // Perform some operations
    return $result;
}

In the above PHP code, the process function is taking an argument $data which is not type hinted. Hence, it can be of any data type (integer, string, array, object, etc.). This is a type of Improper Type Assignation vulnerability.

The variable $result is assigned the value of $data and then returned after some operations. But, there is no type validation or casting performed on $data. This means that the function can behave unpredictably depending on the type of data passed to it.

For example, if an array is passed when a string is expected, PHP may throw an error or behave unexpectedly. This can lead to bugs that are hard to track down. It can also lead to potential security vulnerabilities if the data is used in a context where certain types are expected.

Furthermore, without knowing the expected type of $data, it becomes harder for developers to understand and use the process function correctly. They must read the function's implementation to determine what types of values it can handle.

This lack of type safety makes the code less robust and more prone to errors. It can also make the code harder to read, understand, and maintain, especially in large codebases.

Steps​

  • Identify the expected type of the variable '$data'.
  • Declare the variable '$data' with the identified type.
  • Ensure that the function 'process' only accepts arguments of the declared type.
  • Perform a type check at the beginning of the function to ensure the input is of the correct type.
  • If the type check fails, handle the error appropriately, either by throwing an exception or returning an error message.

Compliant code​

function process(string $data): string {
    if (!is_string($data)) {
        throw new InvalidArgumentException("Expected data to be of type string");
    }
    $result = $data;
    // Perform some operations
    return $result;
}

The function process now explicitly declares that it expects its argument, $data, to be of type string. This is done by adding string before the $data parameter in the function declaration. This is known as type hinting and it helps to ensure that the function is used correctly.

In addition, the function now also returns a string. This is indicated by the : string after the parentheses in the function declaration. This is known as a return type declaration and it specifies the type of value that the function should return.

Inside the function, there is a type check to ensure that $data is indeed a string. This is done using the is_string function. If $data is not a string, an InvalidArgumentException is thrown. This is an example of defensive programming and helps to catch errors early.

By declaring the expected types of both the input and output, we can make the code safer and easier to understand. It also makes the code more efficient, as it is no longer necessary to identify the variable's data type and cast it every time it is used.

References​

Last updated on