Need

Implementation of robust data validation for response data

Context

• Usage of Scala for functional and object-oriented programming in the JVM environment
• Usage of play.api.mvc for handling HTTP requests and responses in Play Framework

Description

Non compliant code

        import play.api.mvc._

object Application extends Controller {

  def sendResponse = Action { request =>
    val data = request.body.asFormUrlEncoded
    val response = data.get("response").head
    Ok(response)
  }

  def receiveResponse = Action { request =>
    val data = request.body.asFormUrlEncoded
    val previousResponse = data.get("previousResponse").head
    Ok(s"Received response: $previousResponse")
  }
}
        
        

The above Scala code snippet is a simple representation of a Play Framework backend application with two endpoints: sendResponse and receiveResponse.

The sendResponse endpoint is accepting a POST request and extracting the response parameter from the request body. This response is then directly sent back to the client without any data validation.

The receiveResponse endpoint is also accepting a POST request, but this time it's extracting the previousResponse parameter from the request body. This previousResponse is supposed to be the response received from the sendResponse endpoint. However, again there is no data validation performed here.

This code is vulnerable because it blindly trusts the data it receives from the client. If a malicious user modifies the response data in the sendResponse endpoint or the previousResponse data in the receiveResponse endpoint to contain invalid or harmful data, the application will accept it without any checks, potentially leading to serious security issues.

Steps

• Implement data validation on the response data before using it in subsequent requests.
• Validate the response data against expected formats, data types, and constraints.
• Use appropriate validation techniques such as regular expressions, type checking, or custom validation logic.
• Handle validation errors gracefully and provide meaningful error messages to the user.
• Consider using a validation library or framework to simplify the validation process.
• Ensure that the validation is performed on both the server-side and client-side to provide a robust defense against malicious data.
• Regularly review and update the validation logic to adapt to changing requirements and potential new vulnerabilities.

Compliant code

        import play.api.mvc._
import play.api.data._
import play.api.data.Forms._

object Application extends Controller {

  case class ResponseData(response: String)

  val responseForm: Form[ResponseData] = Form(
    mapping(
      "response" -> nonEmptyText
    )(ResponseData.apply)(ResponseData.unapply)
  )

  def sendResponse = Action { implicit request =>
    val errorFunction = { formWithErrors: Form[ResponseData] =>
      BadRequest("Invalid data")
    }

    val successFunction = { data: ResponseData =>
      Ok(data.response)
    }

    responseForm.bindFromRequest.fold(errorFunction, successFunction)
  }

  def receiveResponse = Action { implicit request =>
    val errorFunction = { formWithErrors: Form[ResponseData] =>
      BadRequest("Invalid data")
    }

    val successFunction = { data: ResponseData =>
      Ok(s"Received response: ${data.response}")
    }

    responseForm.bindFromRequest.fold(errorFunction, successFunction)
  }
}
        
        

The updated code includes data validation for the response data. The Play framework's form handling capabilities are used to define a form that maps to a case class ResponseData. This form includes a single field, response, which is validated as non-empty text.

The sendResponse and receiveResponse methods are updated to use this form. The form data is bound from the request, and the result is either a valid ResponseData object or a form with errors.

If the form has errors (i.e., the response data is invalid), the errorFunction is called, which returns a BadRequest response with a message of "Invalid data".

If the form is valid, the successFunction is called, which returns an Ok response with the response data.

This approach ensures that invalid response data is not used in subsequent requests, providing a robust defense against malicious data.

References

• 191. Lack of data validation - Responses