Need

Enforce strict data validation and separation of trusted and untrusted data

Context

• Usage of C# 7.0 for modern language features and enhancements
• Usage of Microsoft.AspNetCore.Mvc for building web applications using the ASP.NET Core MVC framework
• Usage of Microsoft.EntityFrameworkCore for working with databases in .NET applications

Description

Non compliant code

        public class UserController : Controller
{
    // The data from the user is directly stored without any validation
    public IActionResult SaveUser(UserModel user)
    {
        // Store the user data into the database
        _context.Users.Add(user);
        _context.SaveChanges();
        return Ok();
    }
}
        
        

In the above code, the SaveUser method in the UserController is vulnerable to Trust Boundary Violation. This is because it directly takes the UserModel object from the request and stores it into the database without performing any kind of validation on the data.

This is a serious vulnerability as it allows an attacker to send malicious data through the UserModel object which can lead to various security issues such as SQL Injection, Cross-Site Scripting (XSS), etc. It also violates the principle of least privilege which states that code should only be able to access the data and resources it needs to perform its job.

The UserModel object is an example of a trust boundary in the application. It's an object that accepts data from an untrusted source (the user) and is used within a trusted context (the application and its database). When the application doesn't validate or sanitize the data that crosses this boundary, it's a Trust Boundary Violation.

Steps

• Implement input validation to ensure that only trusted data is accepted.
• Use data validation techniques such as input sanitization, data type validation, and length/size checks.
• Apply server-side validation to validate the data before storing it in the database.
• Consider using a validation framework or library to simplify the validation process.
• Separate trusted and untrusted data by using different data structures or structured messages.
• Implement proper data handling and sanitization techniques for untrusted data.
• Educate developers about the importance of data validation and the risks associated with trust boundary violations.

Compliant code

        public class UserController : Controller
{
    private readonly IValidator _validator;

    public UserController(IValidator validator)
    {
        _validator = validator;
    }

    public IActionResult SaveUser(UserModel user)
    {
        // Validate the user data before storing it into the database
        ValidationResult results = _validator.Validate(user);

        if (!results.IsValid)
        {
            return BadRequest(results.Errors);
        }

        // Store the user data into the database
        _context.Users.Add(user);
        _context.SaveChanges();
        return Ok();
    }
}
        
        

The updated code now includes a validation step before storing the user data into the database. This is done using a validation library (FluentValidation is a good option for .NET applications).

An IValidator<UserModel> is injected into the controller. This validator is used to validate the UserModel instance before it is stored in the database. If the validation fails, the method immediately returns a BadRequest response with the validation errors. This ensures that only valid and trusted data is stored in the database.

This approach separates the handling of trusted and untrusted data, as the untrusted data (the incoming UserModel instance) is validated before it is used. This helps to prevent trust boundary violations.

It's important to note that this is just one part of a comprehensive data validation strategy. Other techniques such as input sanitization, data type validation, and length/size checks should also be used as appropriate. Additionally, developers should be educated about the importance of data validation and the risks associated with trust boundary violations.

References

• 089. Lack of data validation - Trust boundary violation