Need

Enforce secure and properly set HTTP headers for the Accept field

Context

• Usage of Dart 2.0 for efficient and modern web and mobile app development
• Usage of Shelf for ORM (Object-Relational Mapping) in Node.js

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;

shelf.Response handleRequest(shelf.Request request) {
  // The application does not set the Accept header
  return shelf.Response.ok('Hello, World!');
}

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(handleRequest);

  shelf.serve(handler, 'localhost', 8080).then((server) {
    print('Serving at http://${server.address.host}:${server.port}');
  });
}
        
        

In the above Dart code, we have a simple server that uses the Shelf framework. The handleRequest function is used to handle incoming requests and respond with 'Hello, World!'.

The vulnerability lies in the fact that the server does not set the Accept HTTP header for the response. This means that the server does not specify what media types are acceptable for the response, which can lead to a potential security risk.

An attacker could exploit this vulnerability by sending a request with a MIME type that the server does not expect or cannot handle correctly. This could lead to unexpected behaviors in the application and potentially cause security issues.

For instance, an attacker could send a request with a malicious Content-Type in the header. Since the server does not specify the Accept header, it might interpret the malicious content and cause harm to the application or its data.

In conclusion, not setting the Accept header or allowing any MIME type in the requests can expose the application to potential attacks and should be avoided.

Steps

• Identify the acceptable MIME types for your application.
• Modify the handleRequest function to set the Accept header with the acceptable MIME types.
• Ensure that the application rejects requests with unacceptable MIME types.

Compliant code

        import 'package:shelf/shelf.dart' as shelf;

shelf.Response handleRequest(shelf.Request request) {
  // Check if the request's Accept header is set to an acceptable MIME type
  if (request.headers['Accept'] != 'application/json') {
    // If not, return a 406 Not Acceptable response
    return shelf.Response(406, body: 'Not Acceptable');
  }

  // If the Accept header is set to an acceptable MIME type, process the request as usual
  return shelf.Response.ok('Hello, World!', headers: {'Content-Type': 'application/json'});
}

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(handleRequest);

  shelf.serve(handler, 'localhost', 8080).then((server) {
    print('Serving at http://${server.address.host}:${server.port}');
  });
}
        
        

The updated code now checks if the request's Accept header is set to an acceptable MIME type ( application/json in this case). If the Accept header is not set to an acceptable MIME type, the application returns a 406 Not Acceptable response. This prevents an attacker from causing unexpected behaviors by sending requests with incorrect content-types.

The handleRequest function has been modified to include a check for the Accept header in the incoming request. If the Accept header is not set to application/json, the function returns a 406 Not Acceptable response. This ensures that the application only processes requests with acceptable MIME types.

The handleRequest function also sets the Content-Type header in the response to application/json. This informs the client about the format of the response body.

By checking the Accept header in the request and setting the Content-Type header in the response, the application can prevent unexpected behaviors caused by incorrect content-types. This makes the application more secure against potential attacks.

References

• 153. Insecure or unset HTTP headers - Accept