Application Security Input Validation: Validating Environment Variables and Config files

Question

I am watching a training video called "Creating Secure J2EE Code". The video makes this statement:

Perform all validation in a secure context on the server. Do not rely on client-side validation as a security mechanism. Validate all application input, including user input, API return values, environment variables, configuration files, and other applications.

Validating environment variables and config files is a new concept to me. Can you please provide a high level overview of what this might look like?

My thoughts are to treat both Environment Variables and Config files similar to user input. I would:

• Sanitize it,
• Test Length (Min & Max),
• Test Range,
• Test format
• Test type (int, decimal, char, etc)

I am assuming config files would contain Key/Value pairs. Im not certain how to handle a configuration file that may contain any other format.

Am I on the right track?

Answer 1

(this should probably be a comment but i's a bit verbose)

Validating environment variables and config files is a new concept to me

At first this struck me as odd - then I remembered that not alJ2EE applications run in a controlled environment. It's a question of trust. I deal with web applications where I'd put more trust in the config of the environment than in the code itself - here that statement makes no sense. OTOH if I were writing an app to be run on desktop PCs then I'd be a bit suspicious of anything fetched from the local system.

I would....sanitize it

No.

Validate inputs (i.e. accept or reject them in their entirety)

Sanitize outputs (convert them to a representation appropriate to the medium they are going into).

Sanitizing inputs is a really bad idea. You don't know where the data is going until your code looks at it. If it can arrive in your code in a state where it can do something unexpected (code injection, buffer overflow etc) then its too late to fix the problem.