0

I read an interesting security article recently that amongst other recommendations suggested data from an external API should be treated like user inputed data.

Well of course that makes a lot of sense. But is anyone sanitising data from well known companies, is there a real risk there?

What kind of things should be mitigated against, just SQL injections and code injections? Is there anyway server-side code could be manipulated if data is not sanitised?

1

You need to sanitize it like it was user inputed data. It doesn't need to be ment evil by the API provider or it could also be the fault of the user giving the data to the API provider. Who says the API provider sanitized the data? Who says the API provider needs to sanitize the same way like you? Maybe the special character is valid for him.

A "'" might be a valid character for the API provider and a persons name could be called "Robert'); DROP TABLE students;--" and you got SQL injected without evil intentions of the API provider but by a mum naming her son like this.

For another example you get data from an API provider and display it on your website and you don't sanatize it: It might contain a special character which breaks your webpage or whole website. It might contain evil javascript/html code which can infect the user machine with a virus. It might contain evil javascript/html code which has the same rights as the user viewing it. A logged in administrator views the page and the javascript deletes or manipulates the website/creates a new user with admin rigts/many more things. Depending how the API data is stored/processed it might read/write security relevant files on the system or create/change files executed on the server. For example a file could be created which is executed by the webserver instead of sent directly to the client. So always sanatize third party data.

Edit to make sure there is no misunderstanding: i am talking about data in the meaning of information representation, not about information per se. Information would be, that an actress is Robert's mum. Information representation could be

{actress: "Robert's mum"}

So make sure this data does not cause an SQL-injection at your side. If you trust the information that the actress was really Robert's mum is another topic.

  • Do you feel that this is needed for all APIs? For example, how about Google's authentication API? – Neil Smithline Jan 19 '16 at 15:02
  • @NeilSmithline At least sanatize the data from it. If you trust the (authentification) information is another topic and I also hope you have read their SLAs and tought about when it fails. Such services had multiple outages in the past. For example at the facebook-login outage last year big parts of the internet were affected because it was the only login option for some sites or the site waited until the connection to facebook login timed out. An interesting video is youtube.com/watch?v=y4GB_NDU43Q ("Single Point of Failure: The (Fictional) Day Google Forgot To Check Passwords"). – H. Idden Jan 19 '16 at 15:57
  • I don't say you shouldn't use it but you should be careful about it and should not blindly add it to your website, especially as your only authentification option. – H. Idden Jan 19 '16 at 15:58
  • Ok I agree about data which is stored and then re-published. But what about the server-side code that reads the API data, is there a first line of defence that would protect the rest of the PHP code for example. Or is that just too unlikely to worry about? – Imag1ne Jan 19 '16 at 18:26
  • 1
    @H.Idden - I was just joking around and following Neil's lead. My point was that any API I write would already be sanitized, so you wouldn't have to worry about this. But from your point of view, my API would be 3rd party so you'd still have to sanitize it. Neil was implying the same thing- you have much bigger fish to fry than worry about SQL injection coming back to you from the Google Authentication API. – TTT Jan 19 '16 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.