Need

Enhanced data authenticity validation for profile images

Context

• Usage of Dart for building cross-platform mobile, web, and desktop applications
• Usage of Shelf for managing and organizing data in a Node.js application

Description

Non compliant code

        import 'package:shelf/shelf.dart' as shelf;

shelf.Response handleRequest(shelf.Request request) {
  var imageUrl = request.headers['imageUrl'];
  var response = shelf.Response.ok('Image URL: $imageUrl');
  return response;
}
        
        

In the above code, the handleRequest function is responsible for handling incoming requests. This function fetches the imageUrl from the request headers and sends it back in the response without any validation.

This is problematic as it does not validate whether the imageUrl is a valid image URL. An attacker could potentially use partial paths or URLs to craft complex attack vectors such as controlled redirects or CSRF (Cross-Site Request Forgery).

For example, an attacker could send a request with a malicious URL in the imageUrl header. Since the system does not validate the imageUrl, it would accept the malicious URL and potentially expose the system to a security risk.

In essence, the vulnerability lies in the lack of authenticity validation for the imageUrl data.

Steps

• Validate the imageUrl header to ensure it's a valid URL. You can use a regular expression or a URL parsing library to do this.
• Check that the URL points to an actual image. You can do this by sending a HEAD request to the URL and checking the 'Content-Type' header in the response. It should start with 'image/'.
• Consider using a whitelist of trusted domains to prevent the use of URLs from potentially malicious sources.
• Implement a mechanism to prevent CSRF attacks. This could be a CSRF token that is sent with every request and validated on the server.
• Consider using a Content Security Policy (CSP) to restrict the sources from which images can be loaded.

Compliant code

        import 'dart:io';
import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf_router/shelf_router.dart';
import 'package:shelf_csrf/shelf_csrf.dart';
import 'package:valid_url/valid_url.dart';

final _whitelist = ['trusteddomain1.com', 'trusteddomain2.com'];

shelf.Response handleRequest(shelf.Request request) {
  var imageUrl = request.headers['imageUrl'];

  // Validate the imageUrl
  if (!isURL(imageUrl)) {
    return shelf.Response(400, body: 'Invalid image URL');
  }

  // Check that the URL points to an actual image
  var httpClient = HttpClient();
  httpClient.headUrl(Uri.parse(imageUrl)).then((request) {
    return request.close();
  }).then((response) {
    if (!response.headers.value('content-type').startsWith('image/')) {
      return shelf.Response(400, body: 'URL does not point to an image');
    }
  });

  // Check the domain against a whitelist
  var uri = Uri.parse(imageUrl);
  if (!_whitelist.contains(uri.host)) {
    return shelf.Response(403, body: 'Image URL not from a trusted domain');
  }

  // Implement CSRF protection
  var csrfMiddleware = createCsrfMiddleware(
    randomString: generateRandomString,
    allowOrigin: (origin) => _whitelist.contains(Uri.parse(origin).host),
  );
  var router = Router();
  router.all('/', csrfMiddleware);

  var response = shelf.Response.ok('Image URL: $imageUrl');
  return response;
}
        
        

The updated code now includes several security measures to validate the image URL and prevent CSRF attacks.

Firstly, the isURL function from the valid_url package is used to validate that the imageUrl is a valid URL. If it's not, a 400 response is returned with a message indicating that the URL is invalid.

Next, a HEAD request is sent to the imageUrl using Dart's HttpClient. The 'Content-Type' header in the response is checked to ensure it starts with 'image/'. If it doesn't, a 400 response is returned with a message indicating that the URL does not point to an image.

The domain of the imageUrl is then checked against a whitelist of trusted domains. If the domain is not in the whitelist, a 403 response is returned with a message indicating that the image URL is not from a trusted domain.

Finally, CSRF protection is implemented using the shelf_csrf package. A CSRF middleware is created and added to the router. The allowOrigin function is used to restrict the origins that are allowed to send requests to the server to those in the whitelist.

The response is then returned as before, but now with the added security measures.

References

• 327. Insufficient data authenticity validation - Images