Incorrect Behavior Order: Early Validation

Description

Product needs to validate data at the proper time, after data has been canonicalized and cleansed. Early validation is susceptible to various manipulations that result in dangerous inputs that are produced by canonicalization and cleansing.

Demonstrations

The following examples help to illustrate the nature of this weakness and describe methods or techniques which can be used to mitigate the risk.

Note that the examples here are by no means exhaustive and any given weakness may have many subtle varieties, each of which may require different detection methods or runtime controls.

Example One

The following code attempts to validate a given input path by checking it against an allowlist and then return the canonical path. In this specific case, the path is considered valid if it starts with the string "/safe_dir/".

String path = getInputPath();
if (path.startsWith("/safe_dir/"))
{
  File f = new File(path);
  return f.getCanonicalPath();
}

The problem with the above code is that the validation step occurs before canonicalization occurs. An attacker could provide an input path of "/safe_dir/../" that would pass the validation step. However, the canonicalization process sees the double dot as a traversal to the parent directory and hence when canonicized the path would become just "/".

To avoid this problem, validation should occur after canonicalization takes place. In this case canonicalization occurs during the initialization of the File object. The code below fixes the issue.

String path = getInputPath();
File f = new File(path);
if (f.getCanonicalPath().startsWith("/safe_dir/"))
{
  return f.getCanonicalPath();
}

Example Two

This script creates a subdirectory within a user directory and sets the user as the owner.

function createDir($userName,$dirName){
  $userDir = '/users/'. $userName;
  if(strpos($dirName,'..') !== false){
    echo 'Directory name contains invalid sequence';
    return;
  }
  //filter out '~' because other scripts identify user directories by this prefix
  $dirName = str_replace('~','',$dirName);
  $newDir = $userDir . $dirName;
  mkdir($newDir, 0700);
  chown($newDir,$userName);
}

While the script attempts to screen for '..' sequences, an attacker can submit a directory path including ".~.", which will then become ".." after the filtering step. This allows a Path Traversal (CWE-21) attack to occur.

See Also