CRV2 FrameworkSpecIssuesSpring - Revision history

EoinKeary at 09:53, 8 August 2013

2013-08-08T09:53:25Z

EoinKeary at 09:42, 8 August 2013

2013-08-08T09:42:13Z

EoinKeary at 09:34, 8 August 2013

2013-08-08T09:34:47Z

EoinKeary: Created page with "==Spring Mass assignment== The mass assignment problem relates to the universal web framework pattern of automatic binding request parameters into model objects. See also MVC..."

2013-08-08T09:02:15Z

Created page with "==Spring Mass assignment== The mass assignment problem relates to the universal web framework pattern of automatic binding request parameters into model objects. See also MVC..."

New page

==Spring Mass assignment==
The mass assignment problem relates to the universal web framework pattern of automatic binding request parameters into model objects. See also MVC/.NET section previously <link here>

Model objects are an object-oriented representation of user input.
They provide methods to get, set etc associated parameters from user input.
The following frameworks provide a mechanism for binding request parameters into request bound objects based on matching request parameter names to object attribute names (based on matching public getter and setter methods).

@@ Line 40: / Line 40: @@
 ==What to look for ==
 When reviewing ORM code such as applications using the frameworks above it is important to veify they they are protected against mass binding attacks. It is suggested to look for the following...
-# '''Rails''': In Ruby on Rails, '''attr_accessible''' allows you to specify which attributes of a model can be altered via mass-assignment (most notably by update_attributes(attrs) and new(attrs)). Any attribute names you pass as parameters will be alterable via mass-assignment, and all others won’t be.
+'''Rails''': In Ruby on Rails, '''attr_accessible''' allows you to specify which attributes of a model can be altered via mass-assignment (most notably by update_attributes(attrs) and new(attrs)). Any attribute names you pass as parameters will be alterable via mass-assignment, and all others won’t be.
 Check config/application.rb for
@@ Line 49: / Line 50: @@
      attr_accessible :fname, :lname
-'''# .NET MVC'''
+'''2 .NET MVC'''
 Bind(include = "name") should be used to define which attributes can be updated.
@@ Line 59: / Line 60: @@
          public boolean isAdmin{ get; set; }
+     }

@@ Line 42: / Line 42: @@
 When reviewing ORM code such as applications using the frameworks above it is important to veify they they are protected against mass binding attacks. It is suggested to look for the following...
-# Rails: In Ruby on Rails, '''attr_accessible''' allows you to specify which attributes of a model can be altered via mass-assignment (most notably by update_attributes(attrs) and new(attrs)). Any attribute names you pass as parameters will be alterable via mass-assignment, and all others won’t be.
+# '''Rails''': In Ruby on Rails, '''attr_accessible''' allows you to specify which attributes of a model can be altered via mass-assignment (most notably by update_attributes(attrs) and new(attrs)). Any attribute names you pass as parameters will be alterable via mass-assignment, and all others won’t be.
 Check config/application.rb for
@@ Line 48: / Line 48: @@
 And also at the top of each model object
      attr_accessible :fname, :lname

← Older revision		Revision as of 09:34, 8 August 2013
Line 5:		Line 5:
	They provide methods to get, set etc associated parameters from user input.		They provide methods to get, set etc associated parameters from user input.
	The following frameworks provide a mechanism for binding request parameters into request bound objects based on matching request parameter names to object attribute names (based on matching public getter and setter methods).		The following frameworks provide a mechanism for binding request parameters into request bound objects based on matching request parameter names to object attribute names (based on matching public getter and setter methods).
		+
		+	# .NET MVC --> Controller method Parameters
		+	#Struts 1 --> ActionForms
		+	#Struts 2 --> Action Attributes
		+	#spring mvc --> Command Object
		+	# Ruby Rails & Grails --> bound request parameters to objects
		+
		+	===Anti-Pattern===
		+	===Example Code===
		+
		+	public class User{ <-- '''object to place request data'''
		+	public long id;
		+	public String fname;
		+	public String lname;
		+	public boolean isAdmin;
		+	}
		+
		+
		+	<form action”/updateUser” method=”post” > <-- '''intened use'''
		+	<input name=”user.fname” />
		+	<input name=”user.lname” />
		+	</form>
		+
		+
		+	The attacker may post a request such as
		+
		+	<form action”/updateUser” method=”post” >
		+	<input name=”user.fname” value="Eoin" />
		+	<input name=”user.lname” value = "OWASP" />
		+	'''<input name=”user.isAdmin” = "True" />'''<-- '''injection'''
		+	</form>
		+
		+	This shall update the user Object isAdmin boolean even though the developer did not intend to do so.
		+
		+	==What to look for ==
		+	When reviewing ORM code such as applications using the frameworks above it is important to veify they they are protected against mass binding attacks. It is suggested to look for the following...
		+
		+	# Rails: In Ruby on Rails, '''attr_accessible''' allows you to specify which attributes of a model can be altered via mass-assignment (most notably by update_attributes(attrs) and new(attrs)). Any attribute names you pass as parameters will be alterable via mass-assignment, and all others won’t be.
		+
		+	Check config/application.rb for
		+	config.active_record.whitelist_attributes = true
		+	And also at the top of each model object
		+	attr_accessible :fname, :lname