Skip to main content

Lack of data validation - Numbers

Need​

Implementation of proper data validation for numbers

Context​

  • Usage of PHP for server-side scripting and web development
  • Usage of Request for making HTTP requests

Description​

Non compliant code​

public function store(Request $request)
{
    $inputNumber = $request->input('number');

    // Business logic
    // ...
}

In the above code snippet, we are getting a number from the user's request and directly using it in our business logic. However, there is a lack of data validation here.

We are assuming that the user will always provide us with a number. But what if the user sends a string or an array or even an object? The business logic might break and this could lead to unexpected behavior in the application.

This is a serious vulnerability as it can lead to potential security risks like Denial of Service (DoS) if the user sends a large amount of data, or it can lead to other unexpected behaviors which might compromise the integrity of the application.

The best practice here is to always validate the user's input before using it in our business logic. This ensures that we are always dealing with the correct and expected data type, which in turn makes our application more robust and secure.

Steps​

  • First, you need to validate the input data. In this case, you should check if the 'number' input is actually a number.
  • You can use Laravel's built-in validation rules to accomplish this. Use the 'numeric' rule to ensure the input is a number.
  • Additionally, consider setting a range for the number if applicable. You can use the 'min' and 'max' validation rules for this.
  • If the validation fails, return a response with an appropriate error message to inform the user about the incorrect input.
  • Finally, only proceed with the business logic if the validation passes.

Compliant code​

public function store(Request $request)
{
    $request->validate([
        'number' => 'required|numeric|min:1|max:100',
    ]);

    $inputNumber = $request->input('number');

    // Business logic
    // ...
}

The updated code now includes a validation step before proceeding with the business logic.

The $request->validate() method is used to apply validation rules to the incoming request data. In this case, we're applying four rules to the 'number' input:

  • required: This rule ensures that the 'number' field must be present in the request data.
  • numeric: This rule ensures that the 'number' field must be a numeric value.
  • min:1: This rule ensures that the 'number' field must have a minimum value of 1. You can adjust this value as per your business requirements.
  • max:100: This rule ensures that the 'number' field must have a maximum value of 100. You can adjust this value as per your business requirements.

If the validation fails, Laravel will automatically redirect the user back to their previous location. Additionally, all of the validation errors will automatically be flashed to the session.

If the validation passes, the code will proceed with the business logic as before. The 'number' input is retrieved from the request data and stored in the $inputNumber variable.

This way, we ensure that the 'number' input is always a valid number within the specified range before it's used in the business logic, thereby preventing any potential issues caused by invalid data.

References​

Last updated on