Skip to main content

Lack of data validation - Responses

Need​

Implementation of data validation for response data

Context​

  • Usage of Ruby 2.0+ for executing Ruby code
  • Usage of Ruby on Rails for web application development

Description​

Non compliant code​

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
  end

  def update
    @user = User.find(params[:id])
    @user.update(user_params)
    redirect_to @user
  end

  private
  def user_params
    params.require(:user).permit(:username, :email)
  end
end

The above code is a simple example of a controller in a Ruby on Rails application. It handles two actions: show and update. The show action retrieves a user by their ID and the update action updates the user's information.

In the update action, it uses the user_params method to filter the parameters that are allowed to be updated. This method uses Rails' strong parameters feature to permit only the :username and :email parameters.

However, the problem here is that there is no validation being done on the data that is being updated. The update action will take whatever data is passed in the :username and :email parameters and save it to the database. This means that if a user were to manipulate the response data and change the :username or :email to invalid data, the application would accept this without any issues.

This lack of data validation can lead to a variety of issues such as data corruption, unexpected application behavior, and even security vulnerabilities. For example, an attacker could exploit this to change a user's email address to one they control, effectively taking over the account.

Steps​

  • Implement server-side validation to validate the data received in the update action.
  • Validate the username and email fields to ensure they meet the required format and length.
  • Use appropriate validation methods provided by the Ruby on Rails framework, such as presence, format, and length validations.
  • Handle validation errors by displaying error messages to the user and preventing the update action from being executed.
  • Consider using a form object or a separate validation class to encapsulate the validation logic and keep the controller code clean.
  • Ensure that the validation is performed before updating the user record to prevent invalid data from being persisted.
  • Consider implementing client-side validation as an additional layer of defense to provide immediate feedback to the user.
  • Regularly review and update the validation rules as the application requirements change.
  • Consider implementing input sanitization to prevent any potential security vulnerabilities.

Compliant code​

class UsersController < ApplicationController
  def show
    @user = User.find(params[:id])
  end

  def update
    @user = User.find(params[:id])
    if @user.update(user_params)
      redirect_to @user
    else
      render :edit, status: :unprocessable_entity
    end
  end

  private
  def user_params
    params.require(:user).permit(:username, :email)
  end
end

class User < ApplicationRecord
  validates :username, presence: true, length: { minimum: 3, maximum: 50 }
  validates :email, presence: true, format: { with: URI::MailTo::EMAIL_REGEXP }
end

The updated code includes server-side validation for the username and email fields in the User model.

The username field is validated for presence and length. The length validation ensures that the username is at least 3 characters and at most 50 characters long.

The email field is validated for presence and format. The format validation uses a regular expression to ensure that the email is in a valid format.

In the update action of the UsersController, the update method is now used in a conditional statement. If the update is successful, the user is redirected to their profile. If the update is not successful, the edit form is re-rendered with a status of unprocessable_entity, and the user sees the validation error messages.

This approach ensures that invalid data is not persisted in the database and provides feedback to the user about any validation errors. It also keeps the controller code clean by encapsulating the validation logic in the model.

References​

Last updated on