Skip to main content

Lack of data validation - Type confusion

Need​

Implementation of proper data validation and type checking

Context​

  • Usage of PHP for server-side scripting and web development
  • Usage of Request for making HTTP requests in Node.js

Description​

Non compliant code​

public function store(Request $request)
{
    $data = $request->all();

    $number = $data['number'];

    // Process the number
}

In the above code, we are accepting a number from the user and directly using it in our application. There is no validation to ensure that the input is indeed a number.

This can lead to a type confusion vulnerability where the server interprets the input in an unexpected way. For example, if a user sends the value 0xff, it would be interpreted as 255 instead of throwing an error or ignoring the input.

This can lead to unexpected behavior in the application, and in the worst case, it could be exploited by an attacker to bypass checks or manipulate the application's behavior.

Steps​

  • Validate the input data to ensure it is of the expected type.
  • Use server-side validation to check if the input is a number.
  • Reject any input that does not strictly conform to the expected format.
  • Consider using a library or built-in function to parse the input number to ensure it is a valid number and not a hexadecimal or other non-numeric value.
  • Always sanitize and validate input data, regardless of the source or format.

Compliant code​

public function store(Request $request)
{
    $request->validate([
        'number' => 'required|numeric',
    ]);

    $number = $request->input('number');

    // Process the number
}

The updated code now includes a validation rule that checks if the 'number' field from the request is indeed a numeric value. This is done using Laravel's built-in validation method $request->validate().

The validate method is used to automatically validate incoming HTTP request with a variety of powerful validation rules. In this case, we are using two rules: required and numeric.

  • required rule: The field under validation must be present in the input data and not empty.
  • numeric rule: The field under validation must have a numeric value.

If the validation fails, an exception will be thrown and the proper error response will automatically be sent back to the user. If the validation passes, the code will continue to execute and the 'number' field value will be stored in the $number variable.

This way, we ensure that the input is a number and not a hexadecimal or other non-numeric value, thus fixing the type confusion vulnerability.

References​

Last updated on