Need

Enforce secure and properly set HTTP headers, including the Content-Type header, in server responses.

Context

• Requirement of Ruby 2.0 or later for running the application
• Usage of Rails framework for building web applications

Description

Non compliant code

        class ApplicationController < ActionController::Base
  def index
    render text: "Hello, World!"
  end
end
        
        

The above code represents a simple Ruby on Rails controller with an index action. This action responds with a plain text message "Hello, World!".

The vulnerability here is that the Content-Type header is not being explicitly set in the server's response. The Content-Type HTTP header is important as it tells the client what the content type of the returned content actually is.

If this header is not set, the client might guess the wrong content type, which could lead to security issues. For instance, an attacker could trick the browser into interpreting the content as something malicious, like a script, leading to Cross Site Scripting (XSS) attacks.

In the given code, the server relies on the default behavior of the Rails framework to set the Content-Type header, which might not always be secure or accurate.

Steps

• Identify the appropriate Content-Type for the response.
• Set the Content-Type header in the server response.
• Ensure that the Content-Type header is set correctly for each response in the application.

Compliant code

        class ApplicationController < ActionController::Base
  def index
    response.headers["Content-Type"] = "text/html; charset=utf-8"
    render text: "Hello, World!"
  end
end
        
        

The original code was vulnerable because it did not set the Content-Type HTTP header in the server response. This could potentially lead to security issues such as MIME type confusion attacks.

The fixed code sets the Content-Type HTTP header to text/html; charset=utf-8 before rendering the response. This tells the client that the server is sending an HTML document, and the character encoding for the document is UTF-8.

This fix ensures that the Content-Type header is set correctly for each response in the application, mitigating the risk of potential security vulnerabilities.

References

• 329. Insecure or unset HTTP headers - Content-Type