Skip to main content

Lack of data validation - Web Service

Need​

Implementation of robust data validation and input sanitization mechanisms

Context​

  • Usage of Scala for building scalable and high-performance applications
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
  • Usage of play.api.libs.json for JSON parsing and manipulation in Play Framework

Description​

Non compliant code​

import play.api.mvc._
import play.api.libs.json._

class ApplicationController extends Controller {
  def submitData = Action(parse.json) { request =>
    val jsonBody: Option[JsValue] = request.body.asJson

    jsonBody.map { json =>
      val data: String = (json \\ "data").as[String]
      Ok("Received: " + data)
    }.getOrElse {
      BadRequest("Expecting application/json request body")
    }
  }
}

In the above Scala Play Framework code, the submitData function is handling an incoming JSON request. It is extracting a string value from the "data" field in the JSON without any validation of the input. This means that the server is accepting all kinds of data, including special characters, without any restrictions on the size of the data field.

This lack of data validation can lead to several security vulnerabilities:

  • Injection Attacks: Special characters in the input could be interpreted as part of a command or query, leading to SQL Injection, Command Injection or Cross-Site Scripting (XSS) attacks.

  • Buffer Overflow Attacks: Without a limit on the size of the input, an attacker could send a very large amount of data, potentially causing a buffer overflow.

  • Denial of Service (DoS) Attacks: An attacker could send a large amount of data, consuming server resources and potentially causing a Denial of Service.

To mitigate these vulnerabilities, it's necessary to implement proper data validation. This can include checking for special characters, validating the type and format of the input, and limiting the size of the input.

Steps​

  • Implement server-side data validation to ensure that only valid data is accepted.
  • Validate the data received in the 'data' field to prevent the use of special characters.
  • Implement size restrictions on the fields to prevent excessive data from being sent to the server.
  • Use appropriate validation libraries or frameworks to simplify the data validation process.
  • Handle validation errors gracefully and provide meaningful error messages to the client.

Compliant code​

import play.api.mvc._
import play.api.libs.json._
import play.api.data.validation.ValidationError

class ApplicationController extends Controller {
  def submitData = Action(parse.json) { request =>
    val jsonBody: Option[JsValue] = request.body.asJson

    jsonBody.map { json =>
      val data: String = (json \\ "data").as[String]

      // Validate the data
      if (isValidData(data)) {
        Ok("Received: " + data)
      } else {
        BadRequest("Invalid data received")
      }
    }.getOrElse {
      BadRequest("Expecting application/json request body")
    }
  }

  // Function to validate the data
  def isValidData(data: String): Boolean = {
    val specialCharacters = List('!', '@', '#', '$', '%', '^', '&', '*', '(', ')', '-', '+', '=', '{', '}', '[', ']', '|', '\\\\', ':', ';', '<', '>', '?', '/', '~', '`')

    // Check for special characters
    if (data.exists(specialCharacters.contains)) {
      return false
    }

    // Check for size restrictions
    if (data.length > 500) {
      return false
    }

    true
  }
}

The updated code includes a server-side data validation function isValidData that checks the data received in the 'data' field. This function checks for the presence of special characters and the size of the data.

The list of special characters is defined in the specialCharacters list. If any of these characters are found in the data, the function returns false, indicating that the data is invalid.

The function also checks the size of the data. If the size of the data exceeds 500 characters, the function returns false, indicating that the data is too large.

If the data passes both of these checks, the function returns true, indicating that the data is valid.

In the submitData function, the isValidData function is called to validate the data before it is processed. If the data is invalid, a BadRequest response is returned with the message "Invalid data received". If the data is valid, it is processed and a Ok response is returned.

This approach ensures that only valid data is accepted by the server, preventing potential attacks that could exploit the lack of data validation.

References​

Last updated on