Skip to main content

Lack of data validation - Dates

Need​

Implementation of robust data validation for date fields

Context​

  • Usage of Scala for functional and object-oriented programming in the JVM environment
  • Usage of play.api.mvc for handling HTTP requests and responses in Play Framework
  • Usage of play.api.libs.json for JSON parsing and manipulation in Play Framework

Description​

Non compliant code​

import play.api.mvc._
import play.api.libs.json._

class ApplicationController extends Controller {
  
  def updateDate = Action(parse.json) { request =>
    val jsonBody: Option[JsValue] = request.body.asJson

    jsonBody.map { json =>
      val date = (json \\ "date").as[String]
      // The date is directly used without validation
      updateDatabase(date)
      Ok("Date Updated")
    }.getOrElse {
      BadRequest("Expecting application/json request body")
    }
  }

  def updateDatabase(date: String): Unit = {
    // This method updates the database with the new date
  }
}

The above code snippet is an example of a vulnerable Scala backend application using the Play framework. The vulnerability lies in the updateDate method, which accepts JSON input from a client and updates a date field in the database without any validation.

When the updateDate method is called, it expects a JSON body in the request. It extracts the date from the JSON and uses it directly to update the database. This is a critical vulnerability because the server does not verify if the date is in the correct format or within acceptable ranges.

This lack of server-side validation means that an attacker could send a request with an invalid or maliciously crafted date. This could lead to a range of potential issues, including database corruption, application crashes, or unexpected behavior. It also opens up the possibility of more sophisticated attacks, such as SQL Injection if the date is used in a SQL query without proper sanitization.

The application relies on client-side validation to ensure the correctness and safety of the date. However, client-side validations can be easily bypassed, and therefore, cannot be trusted. The server should always perform its own validation to ensure the integrity and security of the data it processes.

Steps​

  • Implement server-side validation for the date field in the updateDate method.
  • Validate the format of the date to ensure it is in the expected format.
  • Check if the user has permission to modify the date field before updating the database.
  • Handle validation errors and unauthorized access appropriately, returning the corresponding HTTP response codes.

Compliant code​

import play.api.mvc._
import play.api.libs.json._
import java.time.LocalDate
import java.time.format.DateTimeParseException

class ApplicationController extends Controller {
  
  def updateDate = Action(parse.json) { request =>
    val jsonBody: Option[JsValue] = request.body.asJson

    jsonBody.map { json =>
      val date = (json \\ "date").as[String]
      // Validate the date format
      if (!isValidDate(date)) {
        BadRequest("Invalid date format")
      } else if (!hasPermissionToUpdateDate(request)) {
        Forbidden("You do not have permission to update the date")
      } else {
        updateDatabase(date)
        Ok("Date Updated")
      }
    }.getOrElse {
      BadRequest("Expecting application/json request body")
    }
  }

  def updateDatabase(date: String): Unit = {
    // This method updates the database with the new date
  }

  def isValidDate(date: String): Boolean = {
    try {
      LocalDate.parse(date)
      true
    } catch {
      case _: DateTimeParseException => false
    }
  }

  def hasPermissionToUpdateDate(request: Request[AnyContent]): Boolean = {
    // Check if the user has permission to update the date
    // This is a placeholder, replace with your own logic
    true
  }
}

The updated code now includes server-side validation for the date field in the updateDate method.

The isValidDate method checks if the date is in the correct format by trying to parse it as a LocalDate. If the parsing fails, it throws a DateTimeParseException, which we catch and return false, indicating that the date is not valid. If the parsing is successful, we return true.

The hasPermissionToUpdateDate method checks if the user has permission to update the date. This is currently a placeholder and should be replaced with your own logic to check the user's permissions.

In the updateDate method, we first check if the date is valid. If it's not, we return a BadRequest with a message indicating that the date format is invalid. If the date is valid, we then check if the user has permission to update the date. If they don't, we return a Forbidden response. If the date is valid and the user has permission, we update the database and return an Ok response.

References​

Last updated on