Need

Enforcement of proper security controls for data creation

Context

• Usage of C# for building robust and scalable applications
• Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core

Description

Non compliant code

        public class PolicyController : Controller
{
    //...
    [HttpPost]
    public async Task CreatePolicy(Policy policy)
    {
        if (ModelState.IsValid)
        {
            _context.Add(policy);
            await _context.SaveChangesAsync();
            return RedirectToAction(nameof(Index));
        }
        return View(policy);
    }
    //...
}
        
        

The CreatePolicy method in the PolicyController is vulnerable to security controls bypass or absence. This method is responsible for creating a new policy and saving it to the database. However, it does not validate the number of beneficiaries associated with the policy.

The Policy class defines a policy that can have a list of Beneficiary instances. The problem is, there is no restriction on the number of beneficiaries that can be added to a policy. This means that an attacker could potentially generate a policy with more than the allowed number of beneficiaries, thus bypassing the restriction and affecting the integrity of the data sent.

This vulnerability can lead to potential data integrity issues. For instance, if the business logic assumes that there can never be more than four beneficiaries for a policy, it may lead to unexpected behavior or incorrect calculations when a policy with more than four beneficiaries is processed.

Steps

• Implement server-side validation to restrict the number of beneficiaries that can be associated with a policy.
• Add a check in the CreatePolicy method to ensure that the number of beneficiaries does not exceed the allowed limit.
• Display an error message to the user if the number of beneficiaries exceeds the limit.
• Consider using a configuration setting to define the maximum number of beneficiaries allowed per policy.
• Ensure that the validation is performed before saving the policy to the database.

Compliant code

        public class PolicyController : Controller
{
    private const int MaxBeneficiaries = 4; // Consider moving this to a configuration setting

    //...

    [HttpPost]
    public async Task CreatePolicy(Policy policy)
    {
        if (ModelState.IsValid)
        {
            if (policy.Beneficiaries.Count > MaxBeneficiaries)
            {
                ModelState.AddModelError("", "You can only add up to " + MaxBeneficiaries + " beneficiaries per policy.");
                return View(policy);
            }

            _context.Add(policy);
            await _context.SaveChangesAsync();
            return RedirectToAction(nameof(Index));
        }
        return View(policy);
    }

    //...
}
        
        

The updated code now includes a server-side validation check to ensure that the number of beneficiaries associated with a policy does not exceed the allowed limit. This is done by adding a conditional statement that checks the count of the Beneficiaries list in the Policy object. If the count exceeds the maximum allowed beneficiaries (defined as a constant MaxBeneficiaries), an error is added to the ModelState and the user is redirected back to the view with the policy data and the error message.

This error message informs the user that they can only add up to a certain number of beneficiaries per policy. If the number of beneficiaries is within the allowed limit, the policy is added to the context and saved in the database.

The MaxBeneficiaries constant is currently hardcoded as 4, but it is recommended to move this to a configuration setting to make it easier to manage and modify if needed.

This validation is performed before saving the policy to the database, ensuring the integrity of the data and preventing the bypass of security controls.

References

• 305. Security controls bypass or absence - Data creation