Skip to main content

Lack of data validation - HTML code

Need​

Ensure proper data validation to prevent HTML code injection

Context​

  • Usage of PHP 7.0 for server-side scripting and web development
  • Usage of Request for making HTTP requests
  • Usage of the User dependency for managing user-related functionality
  • Usage of Hash for secure password storage and data encryption

Description​

Non compliant code​

public function store(Request $request)
{
    $data = $request->all();
    
    // This is the vulnerable part of the code
    $user = new User;
    $user->name = $data['name'];
    $user->email = $data['email'];
    $user->password = Hash::make($data['password']);
    $user->save();
    
    return response()->json($user);
}

This PHP code is a typical Laravel function that creates a new user and saves it to the database. The vulnerability lies in the fact that the code does not perform any data validation on the input received from the user.

The $data array is populated with the all() function, which retrieves all input data without any filtering or validation. This data is then directly used to create a new User object and saved to the database.

The lack of data validation means that a malicious user could potentially submit HTML code as part of the input data. This HTML code would then be saved to the database and returned in the JSON response. If this HTML code is then interpreted by the site receiving the JSON response, this could lead to a Cross-Site Scripting (XSS) attack.

An XSS attack allows an attacker to inject malicious scripts into webpages viewed by other users. These scripts can steal sensitive information, such as login credentials or personal data, and send it to the attacker.

To fix this vulnerability, the code should validate and sanitize all input data before using it. Laravel provides several ways to do this, such as using the validate() function or creating a form request.

Steps​

  • Sanitize the input data to remove any HTML tags or special characters that could be interpreted as code.
  • Use a server-side validation library or framework to validate the input data before saving it to the database.
  • Ensure that the JSON response is properly encoded to prevent any potential HTML injection attacks.
  • Implement a Content Security Policy (CSP) to reduce the risk of Cross-Site Scripting (XSS) attacks.
  • Regularly update and patch your software to protect against known vulnerabilities.

Compliant code​

use Illuminate\\Support\\Facades\\Validator;
use Illuminate\\Validation\\Rule;

public function store(Request $request)
{
    $validator = Validator::make($request->all(), [
        'name' => 'required|string|max:255',
        'email' => [
            'required',
            'string',
            'email',
            'max:255',
            Rule::unique('users'),
        ],
        'password' => 'required|string|min:8',
    ]);

    if ($validator->fails()) {
        return response()->json($validator->errors(), 400);
    }

    $data = $validator->validated();

    $user = new User;
    $user->name = htmlspecialchars($data['name']);
    $user->email = htmlspecialchars($data['email']);
    $user->password = Hash::make($data['password']);
    $user->save();

    return response()->json($user);
}

The updated code now includes a validation step using Laravel's built-in validation features. This ensures that the data being received is in the correct format and meets the specified criteria. For example, the 'email' field must be a valid email address and unique in the 'users' table, and the 'password' field must be at least 8 characters long.

The htmlspecialchars() function is used to sanitize the 'name' and 'email' fields. This function converts special characters to their HTML entities, which prevents any HTML tags or special characters from being interpreted as code.

If the validation fails, the function will return a JSON response with the validation errors and a 400 status code. This provides clear feedback to the client about what went wrong.

Finally, the validated and sanitized data is saved to the database and a JSON response is returned. This response includes the newly created user object.

This approach helps to mitigate the risk of HTML injection attacks by ensuring that only valid and safe data is saved to the database and returned in the JSON response.

References​

Last updated on