HTML allows fields in a web form to be visible or hidden. Hidden fields supply values to a web server but do not provide the user with a mechanism to modify their contents. However, there are techniques that attackers can use to modify these contents anyway. A web servlet that uses a GET form to obtain parameters can also accept these parameters through a URL. URLs allow a user to specify any parameter names and values in the web request. Consequently, hidden form fields should not be considered any more trustworthy than visible form fields.
Noncompliant Code Example
The following noncompliant code example demonstrates a servlet that accepts a visible field and a hidden field, and echoes them back to the user. The visible parameter is sanitized before being passed to the browser, but the hidden field is not.
public class SampleServlet extends HttpServlet {
public void doGet(HttpServletRequest request, HttpServletResponse response)
throws IOException, ServletException {
response.setContentType("text/html");
PrintWriter out = response.getWriter();
out.println("<html>");
String visible = request.getParameter("visible");
String hidden = request.getParameter("hidden");
if (visible != null || hidden != null) {
out.println("Visible Parameter:");
out.println( sanitize(visible));
out.println("<br>Hidden Parameter:");
out.println(hidden);
} else {
out.println("<p>");
out.print("<form action=\"");
out.print("SampleServlet\" ");
out.println("method=POST>");
out.println("Parameter:");
out.println("<input type=text size=20 name=visible>");
out.println("<br>");
out.println("<input type=hidden name=hidden value=\'a benign value\'>");
out.println("<input type=submit>");
out.println("</form>");
}
}
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws IOException, ServletException {
doGet(request, response);
}
// Filter the specified message string for characters
// that are sensitive in HTML.
public static String sanitize(String message) {
// ...
}
}
|
When fed the parameter param1, the web page displays the following:
Visible Parameter: param1
Hidden Parameter: a benign value
However, an attacker can easily supply a value to the hidden parameter by encoding it in the URL as follows:
http://localhost:8080/sample/SampleServlet?visible=dummy&hidden=%3Cfont%20color=red%3ESurprise%3C/font%3E!!!
When this URL is provided to the browser, the browser displays:
Visible Parameter: dummy
Hidden Parameter: Surprise!!!
Compliant Solution
This compliant solution applies the same sanitization to the hidden parameter as is applied to the visible parameter:
public class SampleServlet extends HttpServlet {
public void doGet(HttpServletRequest request, HttpServletResponse response)
throws IOException, ServletException {
response.setContentType("text/html");
PrintWriter out = response.getWriter();
out.println("<html>");
String visible = request.getParameter("visible");
String hidden = request.getParameter("hidden");
if (visible != null || hidden != null) {
out.println("Visible Parameter:");
out.println( sanitize(visible));
out.println("<br>Hidden Parameter:");
out.println( sanitize(hidden)); // Hidden variable sanitized
} else {
out.println("<p>");
out.print("<form action=\"");
out.print("SampleServlet\" ");
out.println("method=POST>");
out.println("Parameter:");
out.println("<input type=text size=20 name=visible>");
out.println("<br>");
out.println("<input type=hidden name=hidden value=\'a benign value\'>");
out.println("<input type=submit>");
out.println("</form>");
}
}
public void doPost(HttpServletRequest request, HttpServletResponse response)
throws IOException, ServletException {
doGet(request, response);
}
// Filter the specified message string for characters
// that are sensitive in HTML.
public static String sanitize(String message) {
// ...
}
} |
Consequently, when the malicious URL is entered into a browser, the servlet produces the following:
Visible Parameter: dummy
Hidden Parameter: <font color=red>Surprise</font>!!!
Risk Assessment
Trusting the contents of hidden form fields may lead to all sorts of nasty problems.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|
IDS14-J | High | Probable | High | P6 | L2 |
Automated Detection
| | | |
|---|
| The Checker Framework | | Tainting Checker | Trust and security errors (see Chapter 8) |
| CodeSonar | | JAVA.IO.INJ.CODE
JAVA.IO.INJ.COMMAND
JAVA.IO.INJ.XSS
JAVA.IO.INJ.DLL
JAVA.IO.INJ.DENIAL
JAVA.IO.TAINT.REFLECTION
JAVA.IO.INJ.SQL
JAVA.IO.TAINT.TRUSTED
JAVA.IO.TAINT.BUNDLE
JAVA.IO.TAINT.CONTROL
JAVA.IO.TAINT.EVAL
JAVA.IO.TAINT.HTTP
JAVA.IO.TAINT.DEVICE
JAVA.IO.TAINT.LDAP.ATTR
JAVA.IO.TAINT.LDAP.FILTER
JAVA.IO.TAINT.LOG
JAVA.IO.TAINT.MESSAGE
JAVA.IO.TAINT.ADDR
JAVA.IO.TAINT.PATH
JAVA.IO.TAINT.REGEX
JAVA.IO.TAINT.RESOURCE
JAVA.IO.TAINT.SESSION
JAVA.IO.TAINT.URL
JAVA.IO.TAINT.XAML
JAVA.IO.TAINT.XML
JAVA.IO.TAINT.XPATH
JAVA.IO.INJ.XSS.EMWP
| Code Injection (Java)
Command Injection (Java)
Cross Site Scripting (Java)
DLL Injection (Java)
DOS Injection (Java)
Reflection Injection (Java)
SQL Injection (Java)
Tainted @Trusted Value (Java)
Tainted Bundle (Java)
Tainted Control (Java)
Tainted Expression Evaluation (Java)
Tainted HTTP Response (Java)
Tainted Hardware Device Property (Java)
Tainted LDAP Attribute (Java)
Tainted LDAP Filter (Java)
Tainted Log (Java)
Tainted Message (Java)
Tainted Network Address (Java)
Tainted Path (Java)
Tainted Regular Expression (Java)
Tainted Resource (Java)
Tainted Session (Java)
Tainted URL (Java)
Tainted XAML (Java)
Tainted XML (Java)
Tainted Xpath (Java)
Cross Site Scripting In Error Message Web Page (Java) |
| Fortify | 6.10.0120 | Hidden_Field | Implemented |
Bibliography
