As I was working on upgrading deprecated ereg_replace() statements in an e-cart sollution I was suddenly puzzled by questions regarding how to handle the submitted data I was working with.
I was working with the add to card function, which from the backend perspective recieves an integer for how many products to add to the cart. As this number is submitted from the website its open for tampering so the data was sanitized before passed to the function. Great - no worries. However, I was wondering...
Train of thought... no sanitization needed!
We are all good people and wish no harm upon others. I am the creator of this e-commerce website so I have delivered the HTML for the form which will always return a number, this means that I should not need to sanitize the number at all I could infact drop trimming the value aswell - something I have a bad habbit of doing by default. However... we do not live in Utopia...
What if there was a problem with the data, just in case? I should make sure the data is proper so that I dont crash anything which would make me look stupid. Should't I do it anyway I think? After all the world does not work the way this train is going...
Train of thought... validating is the answer
In a production environment things are working, atleast they are supposed to do and they have to as anything else would make it unstable. This I guess is crutial for an add to cart functionality so I think I am allowed to think in black and white.
I can assume two possible states of the system, it is either working or broken. If the number submitted does not equal a number which I can typecast to an integer for safe measures after detection I must assume the system is being tampered with. The only other assumption to me has to be the system is full of errors and for the same reason It shouldnt be running at all.
Train of though... 410 Gone
Wouldnt it be better to halt or kill the entire session / IP if such a scenario exists? What is the business practise around for handling errors when sanitizating data? Is this when you fire up the honeypot-collector and proxy the user session to your dev-server for direct analyzis?
There cannot be any reason to keep going I am thinking If I detect anything else than a number in the submitted string? Broken system has no reason to continue I am thinking?
Concluding the trains of thought
Clearly one cannot and must not assume the data submitted is correct so validation of some sort has to be done. But if noone is trying to hack the system, noone is trying to alter the values then it should never be a situation where the data representing the amount is not a positive number (im using add to cart as example) - that is unless - the browser is messing up the data or maby some encoding results in wrong data or, well I do not really know.
What is the common practises to do when you detect something that has to be considered a breach of security? Or do I simply sanitize the data and pretend nothing is wrong, trying to make use of the recieved data best as possible assuming it was well intented.
This is why I wonder if I might aswell just close the session down, as any normal circumstance would never end up with wrong data. If it were the price of a product certainly one would not allow such an error and the system could not continue to operate? That is - what is the purpose of continuing when such an error is detected at all?
Thanks in advance :)
Update, clarification on people being so extremely nice and helpful :D
By no means do I belive that all people are nice or well behaved, and from a security perspective you only need one wrong to crash the system. I am also under the impression to be honest that there are lots of automated systems out there scanning the web for exploits. Dumping compendiums of hacking tactics on websites targeting a-z 24/7 for the excitement of being able to deface the site that comes up in the daily breakfast log of possible exploitable sites. I learned about Netsparker this way.
I believe I didnt ask my question correctly, I can see that from the answers given so added last point named "concluding the trains..."