Using an Allow-list in a Way Static Analysis can Detect

Using an Allow-list in a Way Static Analysis can Detect

 

What is an Allow-list?

An allow-list is a form of input validation that explicitly specifies a set of permitted values while all other unspecified values are implicitly disallowed. It constitutes a solid remediation tactic for many flaw classes, such as CWE 73 (External Control of File Name or Path), CWE 918 (Server-Side Request Forgery) or CWE 78 (OS Command Injection). When applied accurately, Veracode Static Analysis can detect allow-lists and automatically close the corresponding flaw. How to do this, is the topic of this knowledge article.
 

Example Scenario:

Say we have a Java backend that opens an image while the filename is provided by the frontend. There are 3 different images that can be opened: “Daenerys.jpg”, “Arya.jpg” and “Tyrion.jpg”. The files are stored under /var/www/images/. Since the filename comes from outside the application, we apply strict input validation to avoid CWE 73. Without this, an attacker might be able to access arbitrary files by means of directory traversal attacks (also called “dot dot slash” attack – named after its attack vector). As an example, an attacker may try to obtain the data stored in /etc/passwd by providing a filename of the form: “../../../etc/passwd”. There are multiple tactics to deal with CWE 73, but the one we focus on in this article is an allow-list (for more info on CWE 73 handling strategies, see https://community.veracode.com/s/article/how-do-i-fix-cwe-73-external-control-of-file-name-or-path-in-java).

Without any input validation, we would have something like the following vulnerable code:

// DON’T DO THIS
String filename = request.getParameter("filename");
String basePath = "/var/www/images/";
File image = new File(basePath + filename); // CWE 73
// … return the image to the user
 

How Ideally NOT to Apply the Allow-list:

First, we describe how ideally not to do it. The following code snippet does prevent CWE 73 but, however, Veracode Static Analysis would not be able to automatically detect this way and you would have to propose a mitigation.

String filename = request.getParameter("filename");
String basePath = "/var/www/images/";

// allow-list for the filename  
switch (filename) {
   case "Daenerys.jpg":
     break;          
   case "Arya.jpg":
             break;
       case "Tyrion.jpg":
             break;
       default:
             throw new AccessDeniedException(basePath + filename);
}

File image = new File(basePath + filename);

 

How to Apply the Allow-list:

In the following, we describe our recommended way to leverage an allow-list. Not only is this a totally legitimate solution against CWE 73, but the flaw would also be closed automatically by Veracode Static Analysis.

// SAFE from CWE 73 and automatically detected -> DO THIS

String filename = request.getParameter("filename");
String basePath = "/var/www/images/";
String safeFilename = "";

// allow-list  
switch (filename) {
       case "Daenerys.jpg":
             safeFilename = "Daenerys.jpg";
             break;                          
       case "Arya.jpg":
             safeFilename = "Arya.jpg";
             break;               
       case "Tyrion.jpg":
             safeFilename = "Tyrion.jpg";
             break;    
       default:
             throw new AccessDeniedException(basePath + filename);
}

File image = new File(basePath + safeFilename); // we use safeFilename here!    

This code snippet has the same effect as the one above. However, the allow-list is applied in a way that Veracode Static Analysis can detect it. The reason for that is that it can trace the filename back to a hardcoded value as opposed to a potentially malicious value coming from the request.

We always recommend implementing a way that solves the issue and makes is as easy as possible for static analysis, and other engineers that may audit your application, to spot the controls in place.

Topics (1)

Related Articles

Related Topics

    Ask the Community

    Get answers, share a use case, discuss your favorite features, or get input from the Community.