Skip to main content

Insufficient data authenticity validation

Need​

Enhanced data authenticity validation and permission control

Context​

  • Usage of Ruby 2.7 for Ruby programming and development
  • Usage of Ruby for building dynamic and object-oriented applications
  • Usage of Rails framework for building web applications

Description​

Non compliant code​

class UsersController < ApplicationController
  def update
    @user = User.find(params[:id])
    @user.update(user_params)
    redirect_to @user
  end

  private

  def user_params
    params.require(:user).permit(:name, :email, :role)
  end
end

In the above code, the update method in UsersController is vulnerable due to insufficient data authenticity validation. The method is finding the user with the provided id and then updating the user's attributes with the parameters sent in the request.

The user_params method is using the params.require(:user).permit(:name, :email, :role) line to whitelist the parameters that can be sent in the request to update the user. This is a feature of Rails called Strong Parameters, which prevents mass assignment vulnerabilities.

However, the problem here is that there is no validation to check if the current user has the permission to modify certain fields like role. This can lead to privilege escalation if a malicious user can send a request to update the role of their user to admin.

Furthermore, the code does not validate the authenticity of the data provided. For example, it allows to use invalid data in some fields, like non-existing names. This can lead to data integrity issues if a user can change their name to a non-existing one.

This vulnerability can be exploited by an attacker to escalate privileges or to corrupt the data in the application.

Steps​

  • Implement server-side validation to ensure that the user has permission to modify the specified fields.
  • Verify the authenticity of the data being submitted by the user.
  • Perform input validation to ensure that the data is valid and meets the required criteria.
  • Handle invalid data gracefully and provide appropriate error messages to the user.
  • Consider implementing role-based access control to restrict certain fields from being modified by unauthorized users.

Compliant code​

class UsersController < ApplicationController
  before_action :set_user, only: [:update]
  before_action :validate_user, only: [:update]

  def update
    if @user.update(user_params)
      redirect_to @user
    else
      render :edit, status: :unprocessable_entity
    end
  end

  private

  def set_user
    @user = User.find(params[:id])
  end

  def validate_user
    unless current_user.admin? || current_user == @user
      redirect_to root_path, alert: 'You do not have permission to modify this user.'
    end
  end

  def user_params
    params.require(:user).permit(:name, :email, :role)
  end
end

The updated code includes a before_action filter to set the user and validate the user before the update action is performed.

In the set_user method, the user is fetched from the database using the id parameter from the request.

The validate_user method checks if the current user is an admin or the user that is being updated. If not, it redirects the user to the root path with an alert message indicating that they do not have permission to modify the user. This ensures that only authorized users can modify user data.

In the update action, the user's data is updated using the user_params method. If the update is successful, the user is redirected to their profile page. If the update fails, the edit page is rendered again with a status of unprocessable_entity, indicating that the server could not process the request due to invalid data.

The user_params method uses strong parameters to whitelist the name, email, and role fields. This prevents mass assignment vulnerabilities by ensuring that only the specified fields can be updated.

References​

Last updated on