Skip to main content

Lack of data validation - Emails

Need​

Implementation of email validation to prevent the use of disposable mailboxes

Context​

  • Usage of Swift for iOS and macOS app development
  • Usage of UIKit for building modern and responsive user interfaces
  • Usage of Foundation for building responsive and accessible web interfaces

Description​

Non compliant code​

import UIKit
import Foundation

class ViewController: UIViewController {

    @IBOutlet weak var emailTextField: UITextField!
    
    func registerUser() {
        let email = emailTextField.text
        // Vulnerable code: No check if the email is from a disposable mailbox
        let url = URL(string: "https://yourserver.com/api/register")!
        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        let postString = "email=\\(email)"
        request.httpBody = postString.data(using: .utf8)
        let task = URLSession.shared.dataTask(with: request) { (data, response, error) in
            if let error = error {
                print("Error: \\(error)")
            } else if let data = data {
                print("Data: \\(data)")
            }
        }
        task.resume()
    }
}

The above Swift code is for a ViewController in an iOS application. This ViewController has a function registerUser() that takes the text from an email text field and sends a POST request to a server to register a new user with that email.

The vulnerable part of this code is that there is no validation to check if the email is from a disposable mailbox like yopmail. This lack of validation can lead to issues like spamming, as disposable mailboxes are often used for one-time registration or spamming purposes.

The email is directly taken from the emailTextField and sent in the POST request to the server without any checks. This allows any email, including those from disposable mailboxes, to be used to register a user.

To fix this vulnerability, the application should implement a check to see if the email is from a known disposable mailbox and prevent the registration if it is.

Steps​

  • Implement server-side email validation to check if the email belongs to a disposable mailbox.
  • Use a reliable email validation library or API to validate the email address before sending it to the server.
  • Consider implementing client-side email validation to provide immediate feedback to the user if the email is invalid.
  • Educate users about the importance of using a valid and non-disposable email address during the registration process.
  • Implement rate limiting or CAPTCHA mechanisms to prevent abuse of the registration process.
  • Regularly update the email validation mechanism to stay up-to-date with new disposable email services.

Compliant code​

import UIKit
import Foundation

class ViewController: UIViewController {

    @IBOutlet weak var emailTextField: UITextField!
    
    func registerUser() {
        guard let email = emailTextField.text, !email.isEmpty else {
            print("Error: Email field is empty")
            return
        }
        
        // Check if the email is from a disposable mailbox
        if isDisposableEmail(email: email) {
            print("Error: Disposable email addresses are not allowed")
            return
        }
        
        let url = URL(string: "https://yourserver.com/api/register")!
        var request = URLRequest(url: url)
        request.httpMethod = "POST"
        let postString = "email=\\(email)"
        request.httpBody = postString.data(using: .utf8)
        let task = URLSession.shared.dataTask(with: request) { (data, response, error) in
            if let error = error {
                print("Error: \\(error)")
            } else if let data = data {
                print("Data: \\(data)")
            }
        }
        task.resume()
    }
    
    // Function to check if the email is from a disposable mailbox
    func isDisposableEmail(email: String) -> Bool {
        // Add your logic here to check if the email is from a disposable mailbox
        // You can use a reliable email validation library or API
        return false
    }
}

The updated code now includes a function isDisposableEmail(email: String) -> Bool that checks if the email is from a disposable mailbox. This function should contain the logic to validate the email address using a reliable email validation library or API.

Before sending the email to the server, the registerUser() function now checks if the email field is empty and if the email is from a disposable mailbox. If the email field is empty or the email is from a disposable mailbox, the function will print an error message and return without sending the email to the server.

This solution helps to prevent the use of disposable email addresses during the registration process. It's also recommended to educate users about the importance of using a valid and non-disposable email address during the registration process, implement rate limiting or CAPTCHA mechanisms to prevent abuse of the registration process, and regularly update the email validation mechanism to stay up-to-date with new disposable email services.

References​

Last updated on