Skip to main content

Lack of data validation - Responses

Need​

Implementation of data validation for response data

Context​

  • Usage of Python 3 for writing and executing Python code
  • Usage of Django for building web applications

Description​

Non compliant code​

from django.http import HttpResponse
from django.views import View

class MyView(View):
    def get(self, request, *args, **kwargs):
        user_input = request.GET.get('user_input', '')
        # Here we are not validating the user_input before sending it in the response
        return HttpResponse('You entered: {}'.format(user_input))

The above Django view is vulnerable due to the lack of data validation in the response. The view is simply taking a user's input from the request and directly including it in the HTTP response without any validation or sanitization.

This can potentially lead to several types of attacks such as Cross-Site Scripting (XSS), SQL Injection, etc. For example, if an attacker modifies the 'user_input' parameter in the response to include malicious scripts or SQL commands, the server will blindly accept this and include it in the subsequent response. This can lead to serious security implications.

To fix this vulnerability, we should always validate and sanitize any data that is being sent in an HTTP response.

Steps​

  • Introduce data validation for the 'user_input' parameter. This can be done by checking if the input matches the expected format or values.
  • Use Django's form and field validation methods to validate the 'user_input' before it is used in the response.
  • Consider using Django's built-in escaping methods to ensure that the input is safe to be included in the response.
  • Handle invalid data appropriately. If the 'user_input' is invalid, the application should return an error response and not proceed with the request.

Compliant code​

from django import forms
from django.http import HttpResponse, JsonResponse
from django.views import View

class UserInputForm(forms.Form):
    user_input = forms.CharField(max_length=100)

class MyView(View):
    def get(self, request, *args, **kwargs):
        form = UserInputForm(request.GET)
        if form.is_valid():
            user_input = form.cleaned_data['user_input']
            return HttpResponse('You entered: {}'.format(user_input))
        else:
            return JsonResponse({'error': 'Invalid input'}, status=400)

The above code introduces data validation for the 'user_input' parameter. This is done by using Django's form and field validation methods.

Firstly, a form UserInputForm is defined with a CharField for 'user_input'. This field will automatically validate that the input is a string with a maximum length of 100 characters.

In the get method of MyView, this form is used to validate the 'user_input' from the request. The form is initialized with request.GET which contains the GET parameters.

The is_valid() method of the form is then called to perform the validation. If the form is valid, the cleaned and validated data is accessed via form.cleaned_data['user_input'] and used in the response.

If the form is not valid, meaning that the 'user_input' is invalid, the application returns an error response with a status code of 400 and does not proceed with the request. This is done using JsonResponse to return a JSON response with an 'error' message.

This way, the application ensures that the 'user_input' is validated before it is used in the response, thus fixing the vulnerability.

References​

Last updated on