Instructor: Secure Coding. 2 2
In this lesson, we are going to talk 3 3
about some secure coding best practices, 4 4
and in this lesson, we're going to talk about input validation, 5 5
output encoding, and parameterized queries. 6 6
First, let's talk about input validation. 7 7
Now, I know I've mentioned how important it is 8 8
when I talked about XML and SQL and directory traversals 9 9
and we kept saying input validation was important, 10 10
but we never really defined it. 11 11
Well, input validation is any technique that you use 12 12
to ensure the data entered into a field or a variable 13 13
into an application is handled appropriately 14 14
by that application. 15 15
Now, essentially, when I take something from a user, 16 16
I want to make sure it's actually accurate. 17 17
If you go to my website and you try 18 18
to enter in your username or your password, 19 19
I want to make sure you're giving me valid data 20 20
before I send it to my database to try and see if it works. 21 21
So when we talk about input validation, 22 22
this can be conducted in two ways. 23 23
It can be conducted locally on your client 24 24
or remotely on the server that you're trying to access. 25 25
Now, this means that there's two different ways 26 26
to think about this, but I want to give you 27 27
a big warning here, while client side was used in the past 28 28
a lot, you really should be careful using it. 29 29
When you're using client side input validation, 30 30
it is much more dangerous 31 31
because it's vulnerable to malware interference. 32 32
If I'm testing something on your computer 33 33
before you send it to my server, I am now trusting 34 34
that your computer is doing what I told it to do 35 35
and that can't always be the case 36 36
because attackers can modify that 37 37
and malware can modify that. 38 38
So you may be wondering, 39 39
"Why don't we just do server-side for everything?" 40 40
Well, server-side input validation can be time 41 41
and resource intensive because every time I have 42 42
to check something, that's process cycles on the server 43 43
and while your computer's only serving you, 44 44
my server is serving hundreds of thousands of people 45 45
and so that can take up a lot of resources. 46 46
Now, let me give you a good example of this. 47 47
Let's say you went to my website and you're trying to buy 48 48
your exam voucher for your CySA+ exam. 49 49
You get to the checkout form and it ask for your email 50 50
and you type in jason@notmydomain, but you didn't put .com. 51 51
Notice here it says, "This is not a valid email." 52 52
This isn't being checked by my server, 53 53
this is being checked by your client. 54 54
It knows that the format has 55 55
to be something@something.something, right? 56 56
It knows that's what an email looks like 57 57
and since you didn't do that, it's not going to validate it 58 58
and it won't let you enter this form. 59 59
Now, if you just entered .com here, 60 60
even though that's not a valid email, 61 61
it would still accept it because the client side said, 62 62
"That's good enough 63 63
it just need to be something@something.com." 64 64
Now, input, when you're validating it from the client, 65 65
it still needs to go undergo a server-side validation 66 66
after passing the client side validation. 67 67
For example, a lot of websites will validate on your client 68 68
that that looks like it's in a valid format of email, 69 69
then you send it to the server and they're going to check 70 70
that it's an actually a live email address 71 71
before they process your order, 72 72
that's a server-side validation as well. 73 73
So you can do both and so it doesn't have to be 74 74
either or you can use both. 75 75
Now, let's talk about input here for a second. 76 76
In addition to doing input validation, 77 77
we also want to do what's called 78 78
normalization or sanitization. 79 79
Now, what is this? 80 80
Well, normalization is when you take a string 81 81
and it's stripped of all the illegal characters 82 82
or substrings and it's converted 83 83
to an accepted character set. 84 84
For instance, when you go to my website 85 85
and you enter your name, 86 86
I expect it to be something that has the alphabet in it. 87 87
You know, A, B, C, D, E. 88 88
I don't expect a bunch of numbers or special characters, 89 89
and so if you put in numbers or special characters, 90 90
the system should do input validation either reject it 91 91
or it should normalize it and remove those, 92 92
that's the idea of normalization. 93 93
Now, again, I've mentioned in the past 94 94
the reason why we have to do input validation 95 95
is because we want to prevent people from doing attacks on us 96 96
and some of those attacks are things 97 97
like directory traversals we mentioned. 98 98
Well, one of the attacks that people can use against us 99 99
is known as a canonicalization attack. 100 100
Now, canonicalization is an attack method 101 101
where input characters are encoded in such a way 102 102
to evade vulnerable input validation measures. 103 103
So I'll go back to the example of a directory traversal. 104 104
I'm going to send something that looks like this, 105 105
diontraining.com?user=../../../../etc/config. 106 106
Now, if I don't want to fall victim 107 107
of an attack like this, what can I do? 108 108
I can normalize that data, I can sanitize it and say, 109 109
"Oh, anytime you see ../, just ignore it, 110 110
we're not going to take it, 111 111
and we can either reject it or we can just remove that 112 112
and just pass the etc/config part. 113 113
Now, if somebody wants to try to send this 114 114
as their username, we're not going to process it, 115 115
or if we do, we're not going to fall victim 116 116
of the attack because we've removed those ../. 117 117
Now, what happens if they send me this instead? 118 118
Well, they have diontraining.com?user=%2e%2e%2f, 119 119
you get the idea /etc/config. 120 120
What is this? 121 121
Well, they encoded their input 122 122
to try to get past my validation system. 123 123
So I need to make sure that I'm aware of this type of attack 124 124
because I would need to go and sanitize this input, 125 125
not just for ../, but every variation of ../ 126 126
that may be used by different encoding mechanisms. 127 127
So this is the idea of how you can prevent 128 128
these canonicalization attack. 129 129
Next, we want to talk about output encoding. 130 130
Output encoding is any coding method that's used 131 131
to sanitize the output by converting the untrusted input 132 132
into a safe form where the input is now displayed 133 133
as data to the user without executing 134 134
the code in the browser. 135 135
So let me give you a good example of this. 136 136
Let's say you took that input from somebody 137 137
with all those ../ and then you outputted it back 138 138
to the user and said, "Error, username incorrect. 139 139
Username cannot be ../../../." 140 140
Well, what are you doing there? 141 141
You're having a ability that somebody can actually put code 142 142
into your webpage because if I went and put something 143 143
like parenthesis script as my username 144 144
and then you aired that out and gave it back to me and said, 145 145
"Bracket script alert XSS. 146 146
Bracket script is not a valid username." 147 147
What did you just do? 148 148
You put the script into your website 149 149
and slate it back to me, output encoding prevents that. 150 150
So for example, instead of taking an ampersand, 151 151
you would convert that to &amp;. 152 152
If you take a less than sign, 153 153
you would make that into &lt;. 154 154
Why, because the less than symbol is one of the things 155 155
we used to make the word script insider brackets, 156 156
less than symbol, script greater than symbol. 157 157
So if we change that to &lt; script &gt;, 158 158
that won't execute when you display it back to the user. 159 159
That's the idea of output encoding. 160 160
Output encoding is used to mitigate 161 161
against the code injection and cross it scripting attacks 162 162
that attempt to use input to run that script, 163 163
that's what we're trying to prevent here. 164 164
Now, the third area we want to talk 165 165
about is parameterized queries, 166 166
and this is a great technique that is used to defend 167 167
against SQL injections and insecure object references 168 168
by incorporating placeholders into an SQL query. 169 169
Now, what does this look like? 170 170
Well, when we take these parameterized queries, 171 171
we're really doing a form of output encoding. 172 172
So let me show you a small program that I wrote, 173 173
it's just five lines long and this is a Java program. 174 174
Now, I don't expect you to be able 175 175
to write this code yourself, 176 176
but you should be able to read it 177 177
because Java is considered a high level language 178 178
and it reads fairly much like English. 179 179
So let's take this one line at a time. 180 180
Now, string custname = request.getParameter("customerName") 181 181
String query = "Select account_balance FROM user_data 182 182
WHERE user_name = ?" 183 183
PreparedStatement pstmt = connection.prepareStatement(query) 184 184
pstmt.setString( 1, custname) 185 185
ResultSet results = pstmt.executeQuery( ), 186 186
what is this saying? 187 187
Well, in the first line, this takes the string customer name 188 188
and request you to get the parameter customer name, 189 189
so we're getting input from our user. 190 190
The second line, this is the query we're defining, 191 191
we're defining that the query will always be in this format. 192 192
Select account balance from user data 193 193
where username equals question mark. 194 194
The question mark is essentially what we're going to fill in, 195 195
then we're going to use this prepared statement call, 196 196
which is going to make a connection 197 197
to the database using the query, 198 198
then we're going to make that string get set 199 199
inside the query using the first position, 200 200
that first question mark we found, the only question mark, 201 201
as customer name, and then we're going to get the results 202 202
from executing that query, that's all it is saying. 203 203
So when we're using a parameterized query, 204 204
we're only going to use this format 205 205
when sending it to the database. 206 206
This way, we have different parameterized queries 207 207
for different functions like writing to the database, 208 208
reading from the database, updating from the database 209 209
for certain fields, and we would use those queries 210 210
that have already been defined by the programmers 211 211
instead of trying to create them 212 212
on the fly using customer data. 213 213
That's what we're doing here and this is the idea 214 214
of a prepared statement. 215 215
Now, this is not a fully functional program. 216 216
What am I missing here that can really cause me problems? 217 217
We talked about it at the beginning of this lesson. 218 218
That's right, input validation. 219 219
Nothing here is validating that input. 220 220
So when I'm getting the input from the customer, 221 221
I didn't go through input validation. 222 222
So when I get that input, I should run it through validation 223 223
before I put it into my query 224 224
and into my prepared statement, 225 225
but this was an idea of showing you 226 226
what a parameterized query looks like 227 227
with these prepared statements, and that's what I wanted 228 228
to focus on in this particular code snippet. 229 229
Now, for the exam, you do need to be able to identify 230 230
input validation, output encoding, and parameterized queries 231 231
in a given scenario. 232 232
Remember, anytime you take input from a user, 233 233
you want to do input validation. 234 234
Anytime you're outputting data that came from a user back 235 235
to the screen, you want to use output encoding. 236 236
Anytime you want to connect to an SQL database, 237 237
you should really be using parametrized queries 238 238
because this is a best practice. 239 239
It'll make sure you're taking the minimum amount 240 240
of information from a user 241 241
and putting it into specific fields only 242 242
inside that database by using those parameters queries.