Skip to main content

Insecure functionality - File Creation

Need​

Secure file creation functionality

Context​

  • Usage of Swift for iOS and macOS app development
  • Usage of UIKit for building modern and responsive user interfaces

Description​

Non compliant code​

import UIKit

class ViewController: UIViewController {
    
    @IBOutlet weak var createFileButton: UIButton!
    var user: User?
    
    override func viewDidLoad() {
        super.viewDidLoad()
        
        // Check if the user has the permission to create a file
        if user?.canCreateFile == false {
            createFileButton.isEnabled = false
        }
    }
    
    @IBAction func createFileButtonTapped(_ sender: UIButton) {
        createFile()
    }
    
    // This function creates a file
    func createFile() {
        // Code to create a file
    }
}

struct User {
    var canCreateFile: Bool
}

In the above Swift code, the application checks if the user has the permission to create a file. If the user does not have permission, the "Create File" button is disabled on the front end by setting createFileButton.isEnabled = false.

However, this is a security vulnerability because it only restricts the user on the front end. A malicious user could bypass this front end restriction and still send a request to the server to create a file.

The createFile() function does not check if the user has the necessary permissions to create a file. It just processes the request when it is sent. This means that even if the "Create File" button is disabled on the front end, a malicious user could still potentially create a file by sending a direct request to the server.

This is a case of Insecure Functionality - File Creation vulnerability. The restriction should not just be on the front end but also on the server side. The server should always verify the permissions of the user before processing any request.

Steps​

  • Perform server-side validation and authorization to ensure that the user has the permission to create a file.
  • Remove the client-side check for user permission in the viewDidLoad() method.
  • Implement a server-side API endpoint to handle the file creation request.
  • When the createFileButtonTapped() function is called, send a request to the server-side API endpoint to create the file.
  • Handle any errors or exceptions that may occur during the file creation process and provide appropriate feedback to the user.

Compliant code​

import UIKit

class ViewController: UIViewController {
    
    @IBOutlet weak var createFileButton: UIButton!
    var user: User?
    
    override func viewDidLoad() {
        super.viewDidLoad()
    }
    
    @IBAction func createFileButtonTapped(_ sender: UIButton) {
        createFile()
    }
    
    // This function creates a file
    func createFile() {
        // Send a request to the server-side API endpoint to create the file
        // Handle any errors or exceptions that may occur during the file creation process
        // Provide appropriate feedback to the user
    }
}

struct User {
    var canCreateFile: Bool
}

The updated code removes the client-side check for user permission in the viewDidLoad() method. This is because client-side checks can be easily bypassed, leading to potential security vulnerabilities.

Instead of performing the check on the client side, the createFile() function now sends a request to a server-side API endpoint to create the file. This is a more secure approach as the server can perform robust validation and authorization checks to ensure that the user has the necessary permissions to create a file.

The createFile() function also handles any errors or exceptions that may occur during the file creation process. This is important for providing a good user experience and for preventing the application from crashing in case of an error.

Finally, the function provides appropriate feedback to the user. This could be in the form of a success message if the file was created successfully, or an error message if the file creation process failed for some reason.

References​

Last updated on