Skip to main content

Lack of data validation - Type confusion

Need​

Implementation of strict data validation and type checking

Context​

  • Usage of Node.js v14 for server-side JavaScript development
  • Usage of Express for building web applications and APIs

Description​

Non compliant code​

import express from 'express';

const app = express();

app.get('/api/data', (req, res) => {
  const { value } = req.query;
  
  // Lack of data validation and type confusion vulnerability
  const result = parseInt(value);
  
  res.json({ result });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The vulnerability in this code is a lack of data validation and type confusion.

In the app.get('/api/data') route, the code extracts the value parameter from the query string using req.query. However, it does not perform any validation on the value parameter to ensure that it only contains numbers.

The vulnerable line of code is const result = parseInt(value);. It attempts to parse the value parameter as an integer using the parseInt function. However, this function can also interpret hexadecimal values if the string starts with "0x" or "0X". This introduces a type confusion vulnerability.

An attacker can exploit this vulnerability by passing a value in the form of 0xff as the value parameter. Since the code does not validate the data type, the parseInt function will interpret it as a hexadecimal value and convert it to an integer. This can lead to unexpected behavior and potential security issues.

The impact of this vulnerability is that an attacker can exploit the type confusion to get internal information about the system's operation. They can also inject code and have it interpreted by the server, potentially leading to remote code execution or other malicious activities.

To mitigate this vulnerability, it is recommended to validate the data types on the server-side before processing them. In this case, the code should check that the value parameter only contains numeric characters and reject any input that does not conform to this requirement.

Steps​

  • Validate the data type of the 'value' parameter on the server-side.
  • Use a regular expression or a validation library to ensure that the 'value' parameter only contains numeric characters.
  • If the 'value' parameter is expected to be an integer, use the 'parseInt' function with a radix parameter to prevent type confusion.
  • Handle any validation errors and return an appropriate response to the client.
  • Consider using a validation middleware or a schema validation library to simplify the validation process.

Compliant code​

import express from 'express';

const app = express();

app.get('/api/data', (req, res) => {
  const { value } = req.query;

  // Validate the data type of the 'value' parameter
  if (!/^\\d+$/.test(value)) {
    return res.status(400).json({ error: 'Invalid value. Only numeric characters are allowed.' });
  }

  // Prevent type confusion by parsing the 'value' parameter as an integer
  const result = parseInt(value, 10);

  res.json({ result });
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

The fixed code is written in TypeScript and uses the Express framework to create a server. It addresses the vulnerability by implementing data validation and preventing type confusion.

First, the code imports the necessary modules, including the Express module.

Then, an instance of the Express application is created.

The application defines a route for the '/api/data' endpoint using the HTTP GET method. Inside the route handler, the code retrieves the value of the 'value' parameter from the request query.

To validate the data type of the 'value' parameter, the code uses a regular expression. The regular expression /^\d+$/ ensures that the 'value' parameter only contains numeric characters. If the validation fails, the code returns a 400 Bad Request response with an error message indicating that only numeric characters are allowed.

To prevent type confusion, the code explicitly parses the 'value' parameter as an integer using the parseInt() function. The second argument of parseInt() specifies the base (10 in this case). This ensures that the 'value' parameter is interpreted as a decimal number.

Finally, the code sends a JSON response with the parsed 'value' parameter as the 'result' property.

The server listens on port 3000, and a message is logged to the console when the server starts running.

Overall, the fixed code validates the data type of the 'value' parameter and prevents type confusion by explicitly parsing it as an integer. This helps to ensure that only valid numeric values are accepted and interpreted correctly by the server.

References​

Last updated on