Mass-assignment protection

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages)

This article contains instructions, advice, or how-to content. The purpose of Wikipedia is to present facts, not to train. Please help improve this article either by rewriting the how-to content or by moving it to Wikiversity, Wikibooks or Wikivoyage. (December 2016)

|

This article may be too technical for most readers to understand. Please help improve it to make it understandable to non-experts, without removing the technical details. (December 2016) (Learn how and when to remove this template message)

|

(Learn how and when to remove this template message)

In the computing world, where software frameworks make life of developer easier, there are problems associated with it which the developer does not intend. Software frameworks use object-relational mapping (ORM) tool or active record pattern for converting data of different types and if the software framework does not have a strong mechanism to protect the fields of a class (the types of data), then it becomes easily exploitable by the attackers. These frameworks allow developers to bind parameters with HTTP and manipulate the data externally. The HTTP request that is generated carries the parameters that is used to create or manipulate objects in the application program.

The phrase mass assignment[1] or overposting refers to assigning values to multiple attributes in a single go. It is a feature available in frameworks like Ruby on Rails that allows the modifications of multiple object attributes at once using modified URL. For example,

@person = Person.new(params[:person]) #params contains  multiple fields like name, email, isAdmin and contact

This Mass Assignment saves substantial amount of work for developers as they need not set each value individually.

## Contents

* 1 Threats
* 2 Protection
* 2.1 ASP.NET Core
* 2.2 Ruby
* 3 References

## Threats

In Mass Assignment, a malicious agent can attack and manipulate the data in various ways. It can send the tags which can make him assign various permissions which would otherwise be forbidden. For example, a database schema has a table "users" having field "admin" which specifies if corresponding user is admin or not. Malicious agent can easily send the value for this field to the server through HTTP request and mark himself as an admin. This is called Mass assignment vulnerability. It explores the security breaches that can be done using mass assignment.

[2] GitHub got hacked in 2012 by exploiting mass assignment feature. Homakov who attacked the GitHub gained private access to Rails by replacing his SSH with SSH key of one of the members of Rails GitHub.

## Protection

### ASP.NET Core

In ASP.NET Core use the `Bind` attribute.[3]

[HttpPost]
public IActionResult OnPost(
[Bind("LastName,FirstMidName,HireDate")] Instructor instructor)

### Ruby

We can perform some changes in the active record models to ensure the protection of our data.

1. To use `attr_protected`:[4] We specify the attributes which need to be protected. If the user tries mass assignment, then the user will get an error page which says Mass Assignment Security error and the attribute value will not be changed. This is also called blacklisting [5] In this method, sometimes keeping track of all the attributes we want to protect is difficult. For example, in the code below, assign_project attribute is protected.

Class Person < ActiveRecord::Base
has_many :projects
attr_protected :assign_project
end

This method optionally takes a role option using :as which enables to define multiple mass-assignment groupings. These attributes will have the :default role in case no role role is assigned. Here is an example which illustrates that assign_project will only be visible to admin.

attr_protected :assign_project, :as => :admin

2. To use `attr_accessible`: We add attributes that are accessible to everyone and need not be protected. This is easier to manage as the attributes that can be mass-assigned can be explicitly selected. All others are considered as protected. This is sometimes referred to as whitelisting.[5]

attr_accessible :name, :email, :contact

3. To use Sanitize method: Another configuration which we can do to avoid mass assignment problems is called mass assignment sanitizer. This is a method called sanitize.[6] This method filters the incoming requests and takes care that there should be no malicious tags. It only allows those tags that are whitelisted by the user. If the config `config.active_record.mass_assignment_sanitizer` is set to strict, it will raise `ActiveModel::MassAssignmentSecurity::Error` when mass assignment is not as intended.
4. To use Require and Permit: These methods are used in Rails 4. These provide functionalities that check the incoming requests and parameters. Require method checks whether all the required parameters are present. If not, it throws error. Permit method checks whether a particular parameter is permitted to be passed in mass assignment. It returns the list of the permitted parameters. This is also referred to as strong parameters.

Sometimes developer might forget adding attributes as accessible. So as to avoid this, recent versions of Rail has config setting `config.active_record.whitelist_attributes = true`" which creates blank white list of attributes and protects from Mass Assignment Vulnerability. Models still need to explicitly whitelist or blacklist accessible parameters.

## References

1. ↑ "Ruby on Rails Security Guide — Ruby on Rails Guides". http://guides.rubyonrails.org/security.html#mass-assignment. Retrieved 2016-12-27.
2. ↑ Meyer, David (2012-03-05). "GitHub suspends member over 'mass-assignment' hack". https://www.zdnet.com/home-and-office/networking/github-suspends-member-over-mass-assignment-hack/.
3. ↑ "Model Binding in ASP.NET Core" (in en-us). https://learn.microsoft.com/en-us/aspnet/core/mvc/models/model-binding?view=aspnetcore-7.0#bind-attribute.
4. ↑ "ActiveModel::MassAssignmentSecurity::ClassMethods". http://api.rubyonrails.org/v3.2.9/classes/ActiveModel/MassAssignmentSecurity/ClassMethods.html. Retrieved 2016-12-27.
5. ↑ 5.0 5.1 The Rails 4 Way by Obie Fernandez, Kevin Faustino
6. ↑ "Ruby on Rails Guides: Ruby On Rails Security Guide". http://guides.rubyonrails.org/v3.2.18/security.html. Retrieved 2016-12-27.

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Mass-assignment protection. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Mass-assignment_protection&oldid=4148880"