AWS logo
Amazon QDetector Library

Cross-Site Request Forgery (CSRF) High

Directly using user input into an HTTP request without validating the input can facilitate cross-site request forgery.

Detector ID
ruby/cross-site-request-forgery@v1.0
Category
Common Weakness Enumeration (CWE) external icon
Tags
-

Noncompliant example

1def cross_site_request_forgery_noncompliant
2  user = params[:user_id]
3  users_service_domain = params[:users_service_domain]
4  # Noncompliant: Complete URL is user-controlled.
5  response = Excon.post("#{users_service_domain}/logins", body: {user_id: user}).body
6  token = JSON.parse(response)["token"]
7end

Compliant example

1def cross_site_request_forgery_compliant
2  user = params[:user_id]
3  users_service_path = params[:users_service_path]
4  # Compliant: Only suffix of the URL is controlled by user.
5  response = Excon.post("users-service/#{users_service_path}", body: {user_id: user}).body
6  token = JSON.parse(response)["token"]
7end