Forced Validation Paradigm

class BusinessA{
       public void functionA1(String str) {
              // do something
              Processor.process(str);
       }
       public void functionA2(String str) {
              //do something
              Processor.process(str);
       }
}

class BusinessB{
       public void functionB1(String str) {
              // do something
              Processor.process(str);
       }
}
public class ProcessorDemo{
       public static void main (String args[]) {
              BusinessA a = new BusinessA();
              a.functionA1(args[0]);
              a.functionA2(args[1]);
              BusinessB b = new BusinessB();
              b.functionB1(args[2]);
       }
}

class Processor{
     public static void process(String str) {
		$AttackVectorFunction$(str);	
     }
}

class BusinessA {
	
  public void functionA1(String str) {
		// do something
	      if(validateA1(str)){
              Processor.process(str);
          }
	}
	
  public void functionA2(String str) {
		//do something 
        if(validateA2(str)){
              Processor.process(str);
            }
	  }
}

class BusinessB{
   public void functionB1(String str) {
		// do something
		   if(validateB1(str)){
              Processor.process(str);
               }
	   }
}

Business logic would be :

class BusinessC {
    public void doProcessEmail(String email) {
		// do something
		if(validateEmail(email)){
                  Processor.process(email);
             }
      }

     public void doProcessRequest(String reqId) {
		// do something
		if(validateRequest(reqId)){
                   Processor.process(reqId);
             }
	 }

      public void doProcessSerialId(String serialId) {
		// do something
		if(validateSerialId(serialId)){
                   Processor.process(serialId);
              }
	 }
}

class Processor{
    public static void process(String str) {
		$AttackVectorFunction$(str);	
     }
}

The problem with this implementation $AttackVectorFunction$() is invoked assuming that a Pre-validation is done before calling the Processor.process() by the caller program.

But we may introduce a new business code OR modify the existing code which does not do required Pre-validation.
For example, in the below example, we will invoke the Processor.process() by passing the untrusted OrderId coming from untrusted sources.

Class BusinessD {
     public void doOrder(String orderId) {
            Processor.process(orderId);
        }
}

Where I forget to add validation of Order id, OR I may find it convenient to skip this validation.
In such case, via process()  --> $AttackVectorFunction$() would be invoked without the OrderId validation.
--> Implying that the vulnerability finding is valid.

It is critical as this 1 usage or reference to the process() without validation can bring several types of weaknesses in the software.

How to Fix?
--> using Validation Service Interface

Here, we like to introduce ValidationService as an interface that has a validate() abstract method.

public interface ValidationService {        public boolean validate(Object obj); }

The abstract method validate() will be enforced by its implementors.
Now I would modify the Processor method like this :-

class Processor{
    public static void process(Object obj, ValidationService validator) {
		if(validator.validate(obj)){
			$AttackVectorFunction$(obj);	
		}
    }
}

As we see ‘validator’ passed as an argument will ensure ‘validation’ of the given variable ‘str’ before using the variable for $AttackVectorFunction$(). This is how we could implement forceful validation on it.
This means the Business class should provide the ValidationService instance reference for every call now.
Example:

class BusinessC {

   public void doProcessEmail(String email) {
		      Processor.process(email , new EmailValidator());
	    }
   public void doProcessRequest(String reqId) {
              Processor.process(reqId , new RequestValidator());
        }	
}

In the above example, ‘EmailValidator’ and ‘RequestValidator’ are both implementations of ValidationService.
For instance;

public class EmailValidator implements ValidationService {
	@Override
	public boolean validate(Object obj) {
        if( obj instanceof String )
		{
		// check email string validity.
		}
	}
}
public class RequestValidator implements ValidationService {
	@Override
	public boolean validate(Object obj) {
        if( obj instanceof String )
		{
		// check requested string validity.
		}
	}

}

With this implementation we will be forced to provide ValidationService implementations in every call:
For example in class BusinessD:

Class BusinessD {
     public void doProcessOrder(String orderId) {
                Processor.process(orderId , new OrderValidator());
           }
}

where OrderValidator must be defined:

public class OrderValidator implements ValidationService {
	@Override
	public boolean validate(Object obj) {
        if( obj instanceof String )
		{
		// check orderid string validity.
		}
	}

}

 

class BusinessC {
        public void doProcessEmail(Email useremail) {
		      Processor.process(useremail);
	    }
       public void doProcessRequest(Request req) {
              Processor.process(req);
        }
}
Class BusinessD {
       public void doProcessOrder(Order order) {
              Processor.process(order);
        }
}

class Processor{
public static void process(Object obj) {

		if(obj instanceof Email &&	EmailValidator.getInstance().validate(obj)){
			$AttackVectorFunction$(obj);	
		}else if(obj instanceof Process &&  ProcessValidator.getInstance().validate(obj)){
			$AttackVectorFunction$(obj);	
		}else if(obj instanceof Order && OrderValidator.getInstance().validate(obj)){
			$AttackVectorFunction$(obj);	
		}else{
	            // other validations followed by $AttackVectorFunction$(obj) calls.
		}
   }
}

With the above approach, we keep the signature of Processor.process() to default.

Click Here to see more details on these validation strategies on Page 2 of this article.
Page 2, we will learn how to :
- Mitigate several CWEs ( CWE 501, CWE 601, CWE 566, etc. )
- Define default validators.
- Define AllowList-based validators.