Skip to main content

Lack of data validation - Reflected Parameters

Need​

Implementation of proper input validation and sanitization

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Request for making HTTP requests
  • Usage of a database for storing and retrieving data

Description​

Non compliant code​

public function search(Request $request) {
    $query = $request->get('query');
    
    if(empty($query)) {
        return view('error', ['message' => 'You must provide a search query']);
    }

    $results = DB::table('items')->where('name', 'like', '%' . $query . '%')->get();

    if(empty($results)) {
        return view('error', ['message' => 'No results found for ' . $query]);
    }

    return view('results', ['results' => $results]);
}

This is a simple search function in a Laravel application. It accepts a GET parameter query from the user, uses it to search for items in a database, and returns the results.

The vulnerability lies in the lack of data validation for the query parameter. When no results are found, the function returns an error message that includes the user's query. However, this query is directly appended to the error message without any form of sanitization or encoding.

As a result, if a user provides a query that includes special characters or script tags, these will be included directly in the error message. This opens up the possibility for Cross-Site Scripting (XSS) attacks, where an attacker could inject malicious scripts into the page via the query parameter.

For example, an attacker could use a query such as <script>malicious code here</script>, and this script would then be executed by the browser when the error message is displayed.

This vulnerability could be exploited to steal sensitive information, perform actions on behalf of the user, or even deface the website.

Steps​

  • Sanitize the user input by using a function that escapes special characters.
  • Use prepared statements or parameterized queries when interacting with the database to prevent SQL injection.
  • Implement output encoding when displaying user input in HTML to prevent Cross-Site Scripting (XSS).
  • Consider using a web application firewall (WAF) to filter out malicious input.
  • Implement a Content Security Policy (CSP) to mitigate the risk of XSS.

Compliant code​

public function search(Request $request) {
    $query = e($request->get('query')); // sanitize user input
    
    if(empty($query)) {
        return view('error', ['message' => 'You must provide a search query']);
    }

    $results = DB::table('items')->where('name', 'like', '%' . $query . '%')->get(); // use prepared statement

    if(empty($results)) {
        $safeQuery = htmlspecialchars($query, ENT_QUOTES, 'UTF-8'); // output encoding
        return view('error', ['message' => 'No results found for ' . $safeQuery]);
    }

    return view('results', ['results' => $results]);
}

The updated code includes several security measures to prevent potential vulnerabilities:

  1. Input Sanitization: The e() function in Laravel is used to escape any special characters in the user input. This helps to prevent Cross-Site Scripting (XSS) attacks by ensuring that any special characters in the user input are treated as literal characters rather than executable code.

  2. Prepared Statements: The where clause in the database query is a form of a prepared statement. This means that the user input is treated as a string rather than part of the SQL command. This helps to prevent SQL Injection attacks by ensuring that any user input is treated as literal text rather than part of the SQL command.

  3. Output Encoding: The htmlspecialchars() function is used to convert special characters to their HTML entities when displaying the user input in the error message. This helps to prevent Cross-Site Scripting (XSS) attacks by ensuring that any special characters in the user input are displayed as literal characters rather than executable code.

In addition to these code changes, it is also recommended to implement a Web Application Firewall (WAF) to filter out malicious input and a Content Security Policy (CSP) to mitigate the risk of XSS. These are not shown in the code as they are typically implemented at the server or network level.

References​

Last updated on