Need

Prevention of log injection attacks

Context

• Usage of Dart for building cross-platform mobile, web, and desktop applications
• Usage of Shelf for managing and organizing data in a Node.js application

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;

void handleRequest(shelf.Request request) {
  var untrustedInput = request.requestedUri.queryParameters['input'];
  print('Received request: ${untrustedInput}');
}
        
        

This code represents a log injection vulnerability. The application is using the shelf framework for Dart, a middleware system for handling HTTP requests and responses.

The function handleRequest is designed to handle incoming HTTP requests. It retrieves an untrusted input from the query parameters of the request URI. This input is directly logged to the console without any validation, sanitization, or escaping.

The problem arises when the untrusted input contains malicious characters or strings. For example, an attacker could provide input that includes newline characters or other special sequences, which could be interpreted by the log viewer in a way that hides or alters the true nature of the request.

This could allow an attacker to inject false entries into the logs, or to obfuscate their activities, making it harder for administrators to understand what is really happening in the system. In more severe cases, if the logs are being processed by other systems, the attacker could potentially exploit this vulnerability to execute arbitrary commands or scripts in the context of those systems.

Steps

• Validate the input: Ensure that the input matches a set of strict criteria. This could be a whitelist of acceptable values or a regex pattern.
• Sanitize the input: Remove or replace characters in the input that have special meaning in the context where the input is used. For example, in the context of log files, newline characters could be removed or replaced.
• Escape the input: Transform characters in the input that have special meaning in the context where the input is used into a form that is safe to use. For example, in the context of log files, newline characters could be escaped so they are treated as literal characters rather than control characters.
• Use a logging library that automatically sanitizes and escapes log entries: This can help to ensure that log entries are safe, even if other parts of the code fail to properly validate, sanitize, or escape input.

Compliant code

        import 'package:shelf/shelf.dart' as shelf;
import 'package:html_escape/html_escape.dart';

void handleRequest(shelf.Request request) {
  var untrustedInput = request.requestedUri.queryParameters['input'];
  
  // Validate the input
  if (!isValidInput(untrustedInput)) {
    print('Invalid input received');
    return;
  }

  // Sanitize and escape the input
  var escape = new HtmlEscape();
  var sanitizedInput = escape.convert(untrustedInput);

  print('Received request: ${sanitizedInput}');
}

bool isValidInput(String input) {
  // Add your validation logic here
  // For example, you could check if the input matches a certain pattern
  return true;
}
        
        

The updated code includes a validation step before logging the untrusted input. The isValidInput function is used to check if the input matches a certain pattern or criteria. If the input is not valid, a message is printed and the function returns early.

After validating the input, the code sanitizes and escapes the input using the HtmlEscape class from the html_escape package. This class converts characters in the input that have special meaning in the context where the input is used into a form that is safe to use. For example, in the context of log files, newline characters are escaped so they are treated as literal characters rather than control characters.

By validating, sanitizing, and escaping untrusted input before logging it, the updated code helps to prevent log injection attacks. This is important because log injection attacks can lead to a variety of security issues, including information disclosure, data tampering, and remote code execution.

References

• 091. Log injection