This example demonstrates a shopping interaction in which the user is free to specify the quantity of items to be purchased and a total is calculated.
The user has no control over the price variable, however the code does not prevent a negative value from being specified for quantity. If an attacker were to provide a negative value, then the user would have their account credited instead of debited.
BadJava
...public static final double price = 20.00;int quantity = currentUser.getAttribute("quantity");double total = price * quantity;chargeUser(total);...
This example asks the user for a height and width of an m X n game board with a maximum dimension of 100 squares.
While this code checks to make sure the user cannot specify large, positive integers and consume too much memory, it does not check for negative values supplied by the user. As a result, an attacker can perform a resource consumption (CWE-400) attack against this program by specifying two, large negative values that will not overflow, resulting in a very large memory allocation (CWE-789) and possibly a system crash. Alternatively, an attacker can provide very large negative values which will cause an integer overflow (CWE-190) and unexpected behavior will follow depending on how the values are treated in the remainder of the program.
BadC
...#define MAX_DIM 100... /* board dimensions */ int m,n, error;board_square_t *board;printf("Please specify the board height: \n");error = scanf("%d", &m);if ( EOF == error ){die("No integer passed: Die evil hacker!\n");}printf("Please specify the board width: \n");error = scanf("%d", &n);if ( EOF == error ){die("No integer passed: Die evil hacker!\n");}if ( m > MAX_DIM || n > MAX_DIM ) {die("Value too large: Die evil hacker!\n");}board = (board_square_t*) malloc( m * n * sizeof(board_square_t));...
The following code is a workflow job written using YAML. The code attempts to download pull request artifacts, unzip from the artifact called pr.zip and extract the value of the file NR into a variable "pr_number" that will be used later in another job. It attempts to create a github workflow environment variable, writing to $GITHUB_ENV. The environment variable value is retrieved from an external resource.
The code does not neutralize the value of the file NR, e.g. by validating that NR only contains a number (CWE-1284). The NR file is attacker controlled because it originates from a pull request that produced pr.zip. The attacker could escape the existing pr_number and create a new variable using a "\n" (CWE-93) followed by any environment variable to be added such as:
BadOther
name: Deploy Preview jobs: deploy: runs-on: ubuntu-latest steps: - name: 'Download artifact' uses: actions/github-script with: script: | var artifacts = await github.actions.listWorkflowRunArtifacts({ owner: context.repo.owner, repo: context.repo.repo, run_id: ${{ github.event.workflow_run.id }}, }); var matchPrArtifact = artifacts.data.artifacts.filter((artifact) => { return artifact.name == "pr" })[0]; var downloadPr = await github.actions.downloadArtifact({ owner: context.repo.owner, repo: context.repo.repo, artifact_id: matchPrArtifact.id, archive_format: 'zip', }); var fs = require('fs'); fs.writeFileSync('${{github.workspace}}/pr.zip', Buffer.from(downloadPr.data)); - run: | unzip pr.zip echo "pr_number=$(cat NR)" >> $GITHUB_ENV
The following code is a workflow job written using YAML. The code attempts to download pull request artifacts, unzip from the artifact called pr.zip and extract the value of the file NR into a variable "pr_number" that will be used later in another job. It attempts to create a github workflow environment variable, writing to $GITHUB_ENV. The environment variable value is retrieved from an external resource.
The code does not neutralize the value of the file NR, e.g. by validating that NR only contains a number (CWE-1284). The NR file is attacker controlled because it originates from a pull request that produced pr.zip. The attacker could escape the existing pr_number and create a new variable using a "\n" (CWE-93) followed by any environment variable to be added such as:
GoodOther
The code could be modified to validate that the NR file only contains a numeric value, or the code could retrieve the PR number from a more trusted source.
The following PHP code could be from a shopping cart application. It allows users to apply a discount to an item.
This code does not validate or restrict the discount percentage. An attacker could submit a discount value of 100, making the final price zero, or a value greater than 100, making the final price negative. Depending on how processPayment() handles zero or negative amounts, this could result in unauthorized free purchases or other payment logic flaws, such as getting money credited instead of paying.
BadPHP
$discount = $_POST['discount']; $originalPrice = 100.00; $finalPrice = $originalPrice - ($originalPrice * $discount / 100); processPayment($finalPrice);
The following PHP code could be from a shopping cart application. It allows users to apply a discount to an item.
This code does not validate or restrict the discount percentage. An attacker could submit a discount value of 100, making the final price zero, or a value greater than 100, making the final price negative. Depending on how processPayment() handles zero or negative amounts, this could result in unauthorized free purchases or other payment logic flaws, such as getting money credited instead of paying.
GoodPHP
$original_price = 100.00; $allowed_discounts = [0, 10, 20, 50]; // only these discounts are valid $discount = (int) ($_POST['discount'] ?? 0); if (!in_array($discount, $allowed_discounts, true)) { http_response_code(400); exit('Invalid discount.'); } $final_price = $original_price - ($original_price * $discount / 100); if ($final_price <= 0) { http_response_code(400); exit('Invalid final price.'); } processPayment($final_price);