Skip to main content

Privacy violation

Need​

Protection of user privacy

Context​

  • Usage of Scala for building scalable and functional applications
  • Usage of play.api.mvc for handling HTTP requests in Play Framework
  • Usage of global execution context for concurrent programming in Scala

Description​

Non compliant code​

import play.api.mvc._
import scala.concurrent.ExecutionContext.Implicits.global

class UserController @Inject()(cc: ControllerComponents) extends AbstractController(cc) {

  def getUser = Action.async { implicit request: Request[AnyContent] =>
    val userFuture = UserDatabase.getAllUsers() // Assume this function gets all user data from the database
    userFuture.map { user =>
      Ok(Json.toJson(user)) // Returns all user data including sensitive information
    }
  }
}

In the above code, the getUser function retrieves all users' data from the database and returns it as a JSON response. This is a privacy violation as it exposes sensitive information of all users, such as email, password hashes, and other personal data, to whoever calls this endpoint.

This is a violation of the principle of least privilege, which states that a process should only have access to the resources it needs to perform its function. Here, the endpoint is providing more information than necessary, which can be exploited by malicious actors for identity theft or other harmful activities.

The violation occurs in the line Ok(Json.toJson(user)) where all user data is converted to JSON and returned in the response. This should be replaced with a function that only returns the necessary information, such as usernames or IDs, and hides the sensitive data.

Steps​

  • Identify the sensitive information that is being exposed in the response.
  • Review the privacy requirements and regulations that apply to the system.
  • Determine the appropriate level of privacy protection needed for the exposed information.
  • Implement data anonymization or pseudonymization techniques to protect the sensitive information.
  • Consider implementing access controls to restrict access to sensitive information based on user roles or permissions.
  • Encrypt the sensitive information before storing it in the database.
  • Implement proper authentication and authorization mechanisms to ensure only authorized users can access the sensitive information.
  • Regularly review and update the privacy policies and procedures to ensure compliance with privacy regulations.
  • Perform regular security assessments and penetration testing to identify and address any privacy vulnerabilities.

Compliant code​

import play.api.mvc._
import play.api.libs.json._
import scala.concurrent.ExecutionContext.Implicits.global

case class SafeUser(id: String, name: String) // This is a safe representation of User without sensitive data

class UserController @Inject()(cc: ControllerComponents) extends AbstractController(cc) {

  def getUser = Action.async { implicit request: Request[AnyContent] =>
    val userFuture = UserDatabase.getAllUsers() // Assume this function gets all user data from the database
    userFuture.map { users =>
      val safeUsers = users.map(user => SafeUser(user.id, user.name)) // Only expose non-sensitive data
      Ok(Json.toJson(safeUsers)) // Returns safe user data
    }
  }
}

The original code was exposing all user data, including sensitive information, when the getUser endpoint was hit. This is a privacy violation as it exposes sensitive user information.

The fixed code introduces a new data model SafeUser which only includes non-sensitive user information. When the getUser endpoint is hit, instead of returning all user data, it now maps the user data to the SafeUser model and only exposes this safe data.

This fix ensures that sensitive user information is not exposed, thereby addressing the privacy violation. It's also recommended to implement proper authentication and authorization mechanisms to ensure only authorized users can access the user data. Regular security assessments and penetration testing should also be performed to identify and address any privacy vulnerabilities.

References​

Last updated on