Input Validation and Data Sanitization
| Wiki Markup |
|---|
Java language programs can input data from a wide variety of course including command line arguments, the console, files, network data, environment variables, and system properties. Both environment variables and system properties provide user-defined mappings between keys and their corresponding values, and can be used to communicate those values from the environment to a process. According to the Java API \[[API 2006|AA. Bibliography#API 06]\] {{java.lang.System}} class documentation |
Environment variables have a more global effect because they are visible to all descendants of the process which defines them, not just the immediate Java subprocess. They can have subtly different semantics, such as case insensitivity, on different operating systems. For these reasons, environment variables are more likely to have unintended side effects. It is best to use system properties where possible. Environment variables should be used when a global effect is desired, or when an external system interface requires an environment variable (such as
PATH).
When programs execute in a more trusted domain than their environment, the program must assume that the values of environment variables are untrusted and must sanitize and validate any environment values before use.
The
...
| Wiki Markup |
|---|
The following figure (adapted from \[[Tutorials 2008|AA. Bibliography#Tutorials 08]\]) shows this behavior. |
The Myth of Trust
Wiki Markup
When components with differing degrees of trust share data, the data are said to flow across a trust boundary. Because Java allows components under different trusted domains to communicate with each other, data can be transmitted across a trust boundary. Furthermore, a Java program can contain both internally developed and third-party code. Data that are transmitted to or accepted from third-party code also flow across a trust boundary.
While Although software components can obey policies that allow them to transmit data across trust boundaries, they cannot specify the level of trust given to any component. The deployer of the application must define the trust boundaries with the help of a system-wide systemwide security policy. A security auditor can use that definition to determine whether the software adequately supports the security objectives of the application.
ThirdA Java program can contain both internally developed and third-party code. Java was designed to allow the execution of untrusted code; consequently, third-party code should can operate in its own trusted domain; any code potentially exported to a third-party — such as libraries — should be deployable in well-defined trusted domains. The public API of the potentiallysuch third-exported party code can be considered to be a trust boundary. Data flowing across that crosses a trust boundary should be validated when the publisher lacks unless the code that produces this data provides guarantees of validationvalidity. A subscriber or client may omit validation when the data flowing into its trust boundary is appropriate for use as is. In all other cases, inbound data must be validated.
Injection Attacks
Injection Attacks
Data received by a component from a source outside the component's trust boundary may can be malicious . Consequently, the program and can result in an injection attack, as shown in the scenario in Figure 1.
Figure 1. Injection attack
Programs must take steps to ensure that the data are both genuine and appropriate.
data received across a trust boundary is appropriate and not malicious. These steps can include the following:
Validation: Validation is the process of ensuring that input data fall falls within the expected domain of valid program input. For example, not only must method arguments This requires that inputs conform to the type and numeric range requirements of a method or subsystem, but also they must contain data that conform to the required as well as to input invariants for that methodthe class or subsystem.
Sanitization: In many cases, the data may be is passed directly to a component in a different trusted domain. Data sanitization is the process of ensuring that data conforms to the requirements of the subsystem to which they are it is passed. Sanitization also involves ensuring that data also conforms to security-related requirements regarding leaking or exposure of sensitive data when output across a trust boundary. Sanitization may include the elimination of unwanted characters from the input by means of removalremoving, replacementreplacing, encoding, or escaping the characters. Sanitization may occur following input (input sanitizesanitization) or before the data is passed to across a trust boundary (output sanitization). Data sanitization and input validation may coexist and complement each other. Refer to the related guideline IDS01-J. Sanitize data passed across a trust boundary for more details on data sanitizationMany command interpreters and parsers provide their own sanitization and validation methods. When available, their use is preferred over custom sanitization techniques because custom-developed sanitization can often neglect special cases or hidden complexities in the parser. Another problem with custom sanitization code is that it may not be adequately maintained when new capabilities are added to the command interpreter or parser software.
Canonicalization and Normalization: Canonicalization is the process of lossless reduction of the input to its equivalent simplest known form. Normalization is the process of lossy conversion of input data to the simplest known (and anticipated) form. Canonicalization and normalization must occur before validation to prevent attackers from exploiting the validation routine to strip away invalid characters and, as a result, constructing an invaild invalid (and potentially malicious) character sequence. Refer to the guideline IDS02See FIO16-J. Normalize strings Canonicalize path names before validating them for more details. In addition, ensure that normalization is information. Normalization should be performed only on fully assembled user input. Never normalize partial input or combine normalized input with non-normalized input.
For example, POSIX file systems provide a syntax for expressing file names on the system using paths. A path is a string which indicates how to find any file by starting at a particular directory (usually the current working directory), and traversing down directories until the file is found. Canonical paths lack both symbolic links and special entries such as '.' or '..', which are handled specially on POSIX systems. Each file accessible from a directory has exactly one canonical path, along with many non-canonical paths.
nonnormalized input.
Complex subsystems In particular, complex subsystems are often components that accept string data that specifies specify commands or instructions to are a the componentspecial concern. String data passed to these components may contain special characters that can trigger commands or actions, resulting in a software vulnerability.
Examples These are examples of components which that can interpret commands or instructions:
- Operating system command interpreter (see guideline IDS07-J. Do not pass Sanitize untrusted , unsanitized data passed to the Runtime.exec() method)
- A data repository with an a SQL-compliant interface (see IDS00-J. Prevent SQL Injection)
- XML parser
- XPath evaluators
- (see IDS16-J. Prevent XML Injection and IDS17-J. XML External Entity Attacks)
- Regular expression engines (see IDS08-J. Sanitize untrusted data included in a regular expression)
- Formatted output methods (see IDS06-J. Exclude unsanitized user input from format strings)
- XPath evaluatorsA SAX (Simple API for XML) or a DOM (Document Object Model) parser
- Lightweight Directory Access Protocol (LDAP) directory service
- Script engines
Many rules address proper filtering of untrusted input, especially when such input is passed to a component that can interpret commands or instructions.
...
Bibliography
| [Seacord 2015] |