Incomplete Mediation

• Mediation is defined as verifying that the subject is authorized to perform an operation on an object.
• They provide the following example
  • A web based program needs two parameters set in a url
  • http://www.somesite.com/subpage/userinput.asp?param1=(808)555-1212&param2=2015Jan17
  • The first task of userinput.asp should be to check to see if both parameters are valid.
    • Well, after carefully reading them in and making sure they don't overflow any buffers.
  • After that, is the input valid?
    • What if the the value of the second parameter is
      • 1800Jan01
      • 2022Feb30
      • 2048Min(date,-1)
      • 1Aardvark2Many
      • 2022May18;cd /;rm -rf *
    • Each of these can lead to a problem depending on what is done with the data next.
  • I am really guilty of giving assignments and stating that "you may assume that all input is in the proper format".
    • I am fairly confident that 1800 will cause a problem, probably a misinterpretation in many date libraries.
    • And certainly in most hand written date code.
    • The same with the 30 of Feb.
    • There is a chance that the third and fifth line might even escape and cause a problem at a system level.
• You must, when dealing with a critical application Validate All Data.
  • 
  • look here
• While you may think you have valid data due to a restricted interface
  • The interface may be broken
  • The interface may be circumvented
  • Your code may be reused in another way without the protection of the interface.
• They provide what they claim is an actual case of this.
  • A company had a web page that shipped an order form via html to a customer.
  • This included all the details needed to order an item
  • The complete order button returned a call to a url with the appropriate values added in.

  • http://www.things.com/order.asp?customerId=101&partNumber=55&quantity=20&price=10&total=200 

  • But apparently they did not validate this data so the line

  • http://www.things.com/order.asp?customerId=101&partNumber=55&quantity=20&price=10&total=20 

    was valid
  • Apparently this went unnoticed for a while until a security audit found it.
• They end the section with the question how much bad code like this is running today?