Skip to main content

Lack of data validation - Headers

Need​

Implementation of proper data validation for HTTP headers

Context​

  • Usage of PHP 7.0+ for server-side scripting and web development
  • Usage of Illuminate/Http for HTTP request handling in Laravel
  • Usage of Illuminate/Support for providing foundational support classes and utilities in Laravel framework

Description​

Non compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;

class VulnerableController extends Controller
{
    public function index(Request $request)
    {
        $headerValue = $request->header('X-Custom-Header');

        // Use the header value directly without any validation
        return view('index', ['headerValue' => $headerValue]);
    }
}

In the given code snippet, we have a controller named VulnerableController which has a method index that accepts a request object. This request object is used to fetch the value of a custom HTTP header X-Custom-Header.

The vulnerability lies in the fact that the value of the header X-Custom-Header is directly used without any kind of validation. This value is passed directly to the view which could potentially lead to Cross-Site Scripting (XSS) attacks if the header value contains malicious scripts.

Moreover, if this value is used in any database queries, it could also lead to SQL Injection attacks. The integrity of the stored information could be compromised if the attacker is able to manipulate the header values to inject malicious data.

This lack of validation on the HTTP headers makes the application highly susceptible to various kinds of attacks. It is always recommended to validate and sanitize any user provided data before using it in the application.

Steps​

  • Identify all the places in your code where you are using HTTP headers directly without validating them.
  • Implement input validation for all HTTP headers. This can be done using a variety of methods, such as regular expressions, whitelist validation, or built-in validation functions.
  • Ensure that the validation is strict and allows only the expected format. For example, if you expect a numeric value, make sure that the validation rejects anything that is not a number.
  • Consider using a security library or framework that provides built-in functions for input validation to make the process easier and more reliable.
  • After implementing the validation, test your application thoroughly to ensure that the validation works as expected and does not allow any malicious input.

Compliant code​

<?php

namespace App\\Http\\Controllers;

use Illuminate\\Http\\Request;
use Illuminate\\Support\\Facades\\Validator;

class SecureController extends Controller
{
    public function index(Request $request)
    {
        $headerValue = $request->header('X-Custom-Header');

        // Validate the header value
        $validator = Validator::make(['headerValue' => $headerValue], [
            'headerValue' => 'required|alpha_num',
        ]);

        if ($validator->fails()) {
            // Handle validation failure
            return response()->json(['error' => $validator->errors()], 400);
        }

        // Use the validated header value
        return view('index', ['headerValue' => $headerValue]);
    }
}

The updated code now includes a validation step for the HTTP header 'X-Custom-Header'. This is done using Laravel's built-in Validator facade. The validation rule 'required|alpha_num' is used, which means the header value must be present and should only contain alphanumeric characters.

If the validation fails, the application will return a JSON response with a 400 status code and the validation error messages. This way, the application will not proceed with potentially harmful header values.

This validation step helps to prevent XSS attacks or other types of attacks that rely on injecting malicious values into HTTP headers. It's a good practice to always validate user inputs, including HTTP headers, to ensure the security of your application.

References​

Last updated on