Skip to main content

Lack of data validation - Type confusion

Need​

Implementation of strict data validation to prevent type confusion

Context​

  • Usage of Ruby for building dynamic and object-oriented applications

Description​

Non compliant code​

def process_data(data)
  number = data[:number]
  result = number * 10
  return result
end

The above function process_data accepts a data object and tries to extract a number from it. It then multiplies this number by 10 and returns the result. However, this code is vulnerable to type confusion attacks as it does not validate the data type of the input it receives.

The number could be a string that represents a hexadecimal number like "0xff". When this string is multiplied by 10, instead of throwing an error or converting the hexadecimal number to decimal, Ruby interprets the string as zero (since it starts with a '0') and the multiplication operation does not fail. This could lead to unexpected behavior and potential security risks.

For example, if an attacker sends the string "0xff" as the number, the server would interpret it as 0 and return 0 as the result of the multiplication. This could potentially be exploited in a way that could harm the system or leak sensitive information.

Steps​

  • Implement data validation to ensure that the 'number' field only accepts numerical values.
  • Use appropriate data validation techniques such as regular expressions or built-in validation methods provided by the framework.
  • If the field is expected to accept hexadecimal values, convert them to decimal before performing any calculations.
  • Ensure that the data validation is performed on the server-side to prevent any malicious input from being processed.
  • Consider implementing input sanitization techniques to further protect against potential attacks.

Compliant code​

def process_data(data)
  number = data[:number]
  if number.is_a?(Numeric) || (number.is_a?(String) && number.match(/\\A[+-]?\\d+?(\\.\\d+)?\\Z/)) # check if the input is a number
    result = number.to_i * 10
    return result
  else
    raise 'Invalid input. Please enter a number.'
  end
end

The updated code includes a validation check to ensure that the 'number' field only accepts numerical values. This is done using the is_a?(Numeric) method to check if the input is a number. If the input is a string, it checks if the string is a valid number using a regular expression match number.match(/\\A[+-]?\\d+?(\\.\\d+)?\\Z/).

If the input passes the validation check, it is converted to an integer using the to_i method before performing the multiplication operation. This ensures that even if the input is a valid number in string format, it will be correctly processed as a number.

If the input does not pass the validation check, an exception is raised with a message indicating that the input is invalid. This prevents any further processing of the invalid input, protecting the application from potential attacks.

This solution ensures that the data validation is performed on the server-side, preventing any malicious input from being processed. It also implements input sanitization techniques to further protect against potential attacks.

References​

Last updated on