Need

Implementation of robust data validation for URL parameters

Context

• Requirement of Ruby 2.0 or higher for running the application
• Usage of Ruby on Rails for building web applications

Description

Non compliant code

        class DocumentsController < ApplicationController
  def index
    @documents = Document.where(date_sent: params[:date_sent])
  end
end
        
        

This Ruby on Rails controller action is vulnerable due to a lack of data validation. The index action in the DocumentsController retrieves all documents sent on a specific date, which is provided by the user as a parameter in the URL.

The problem here is that no validation or authorization checks are being performed on the date_sent parameter. This means that any user, regardless of their permissions or whether they're logged in or not, can access any documents sent on any date just by manipulating the URL.

For example, if a malicious user were to access the URL http://www.example.com/documents?date_sent=2022-03-01, they would be presented with all documents sent on March 1, 2022. This vulnerability could lead to unauthorized access to sensitive information.

Steps

• Implement input validation to ensure that the 'date_sent' parameter is in the expected format.
• Sanitize the 'date_sent' parameter to prevent any potential SQL injection attacks.
• Limit the access to the 'index' action to authorized users only.
• Consider implementing authentication and authorization mechanisms to control access to sensitive information.
• Avoid exposing sensitive information in the URL parameters.
• Consider using a different approach to retrieve documents based on the date sent, such as implementing a search functionality with proper input validation and filtering.

Compliant code

        class DocumentsController < ApplicationController
  before_action :authenticate_user!
  before_action :sanitize_date, only: [:index]

  def index
    @documents = current_user.documents.where(date_sent: @date_sent)
  end

  private

  def sanitize_date
    @date_sent = Date.parse(params[:date_sent]) rescue nil
    if @date_sent.nil?
      redirect_to root_path, alert: "Invalid date format"
    end
  end
end
        
        

The updated code includes several changes to address the vulnerability:

1. before_action :authenticate_user!
- This line ensures that only authenticated users can access the index action. This is a built-in method provided by Devise, a popular authentication solution for Rails. If you're not using Devise, you'll need to replace this with your own authentication check.

2. before_action :sanitize_date, only: [:index]
- This line adds a new before action that sanitizes the date_sent parameter. This action is only run for the index action.

3. @documents = current_user.documents.where(date_sent: @date_sent)
- This line changes the query to only return documents that belong to the currently authenticated user and were sent on the sanitized date. This ensures that users can only access their own documents.

4. sanitize_date method
- This private method attempts to parse the date_sent parameter into a Date object. If the parsing fails (which would happen if the parameter is not in a valid date format), it redirects the user back to the root path with an alert message. This prevents SQL injection attacks by ensuring that the date_sent parameter is always a valid date or nil.

These changes ensure that the date_sent parameter is properly validated and sanitized, and that users can only access their own documents. They also prevent sensitive information from being exposed in the URL parameters.

References

• 141. Lack of data validation - URL