Need

Protection of personal information from unauthorized access or disclosure

Context

• Usage of Dart 2.0 for building high-performance, cross-platform applications
• Usage of Shelf for managing and organizing data in a Node.js application

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;

void main() {
  var users = [
    {"id": "123456789", "phone": "1234567890"},
    {"id": "987654321", "phone": "0987654321"}
  ];

  var handler = const shelf.Pipeline().addHandler((shelf.Request request) {
    return shelf.Response.ok('User information: $users');
  });

  shelf.serve(handler, 'localhost', 8080).then((server) {
    print('Serving at http://${server.address.host}:${server.port}');
  });
}
        
        

The above Dart code is a simple server application using the Shelf framework. It has a list of users with their ID numbers and phone numbers hard-coded into the source code.

The vulnerability here is that the real user information such as real ID numbers and phone numbers are being stored directly in the source code. This is a bad practice and a serious security risk because anyone who has access to the source code can see this sensitive information.

In the code, we have a list of users and each user is a map with keys 'id' and 'phone'. The values of these keys are real ID numbers and phone numbers. This information is then passed to the shelf.Response.ok method to be displayed when a request is made to the server.

This approach is flawed as it exposes sensitive user information. This can lead to identity theft, fraud and other malicious activities if the information falls into the wrong hands. Therefore, it's crucial to handle such sensitive data properly to prevent any potential data leaks.

Steps

• Remove the hard-coded user information from the source code. Storing sensitive information in the source code is a bad practice and can lead to information leaks.
• Use a secure database to store user information. Ensure that the database is properly configured and that access is restricted to authorized personnel only.
• Implement proper authentication and authorization mechanisms to ensure that only authorized users can access the user information.
• Encrypt sensitive user information before storing it in the database. This will ensure that even if the data is leaked, it will be useless without the decryption key.
• Do not include sensitive user information in server responses unless necessary. If it is necessary, ensure that the data is securely transmitted, for example by using HTTPS.

Compliant code

        import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;
import 'package:dotenv/dotenv.dart' as dotenv;

void main() async {
  dotenv.load();

  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests()).addHandler(_echoRequest);

  var server = await io.serve(handler, 'localhost', 8080);

  print('Serving at http://${server.address.host}:${server.port}');
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}
        
        

The updated code no longer contains hard-coded user information. Instead, it uses the dotenv package to load environment variables from a .env file. This file should be added to your .gitignore to prevent it from being committed to your version control system.

The dotenv.load() function is called at the start of the main function. This loads the environment variables from the .env file into the application's environment.

The handler function has been updated to no longer return user information in the response. Instead, it simply returns a message indicating the requested URL. This is a placeholder response and should be replaced with your own logic for handling requests.

The io.serve function is used to start the server. The server listens on the localhost address and port 8080. These values can be replaced with your own values or loaded from environment variables.

The _echoRequest function is a handler function that is called for each request. It takes a shelf.Request object as a parameter and returns a shelf.Response object. This function simply returns a response with a message indicating the requested URL. This function should be replaced with your own logic for handling requests.

Remember to store sensitive data like user information in a secure database and implement proper authentication and authorization mechanisms to ensure that only authorized users can access the user information. Also, consider encrypting sensitive user information before storing it in the database.

References

• 226. Business information leak - Personal Information