Skip to main content

Lack of data validation - Dates

Need​

Implementation of robust data validation for date fields

Context​

  • Requirement of Ruby 2.0 or later for running the application
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class ApplicationController < ActionController::Base
  def update
    @user = User.find(params[:id])
    @user.update_attributes(params[:user])
    redirect_to @user
  end
end

The above code is an example of a vulnerable Ruby on Rails controller method that does not validate the incoming data before updating the user's attributes.

In the update method, the application is finding a user by their ID and then updating their attributes based on the parameters sent in the request. The problem here is that there is no validation on what parameters can be updated. This means that a malicious user could potentially send a request with parameters that they should not have access to update, such as changing another user's password or email.

This vulnerability is due to a lack of server-side data validation. While there may be restrictions on the front end to prevent certain fields from being updated, those can be bypassed by sending a direct request to the server. As the server does not validate the incoming data, it processes these requests as valid and updates the user's attributes accordingly.

Steps​

  • Implement server-side validation for the fields that require permission to modify.
  • Validate the user's permission before allowing the update operation.
  • Use strong parameters to whitelist and validate the parameters being updated.
  • Consider implementing role-based access control to restrict certain fields from being modified by unauthorized users.

Compliant code​

class ApplicationController < ActionController::Base
  before_action :set_user, only: [:update]
  before_action :check_permission, only: [:update]

  def update
    if @user.update(user_params)
      redirect_to @user
    else
      render :edit
    end
  end

  private

  def set_user
    @user = User.find(params[:id])
  end

  def check_permission
    unless current_user.can_edit?(@user)
      redirect_to root_path, alert: 'You do not have permission to edit this user.'
    end
  end

  def user_params
    params.require(:user).permit(:name, :email) # Add the fields that are allowed to be updated
  end
end

The updated code now includes server-side validation for the fields that require permission to modify.

The set_user method is used to find the user that needs to be updated. This method is called before the update action is executed.

The check_permission method is used to validate the user's permission before allowing the update operation. If the current user does not have permission to edit the user, they are redirected to the root path with an alert message. This method is also called before the update action is executed.

The update method now uses strong parameters to whitelist and validate the parameters being updated. The user_params method is used to specify which parameters are permitted. In this case, only the name and email fields are allowed to be updated. If the update is successful, the user is redirected to the user's page. If the update is not successful, the edit page is rendered again.

This code also considers implementing role-based access control to restrict certain fields from being modified by unauthorized users. The can_edit? method (which is not shown in this code) should be implemented in the User model to check if the current user has the necessary permissions to edit the user.

References​

Last updated on