3

I've got a component that is launched from a quick action and on init preforms some DML and redirects the user. It only implements these three interfaces and is not referenced anywhere else in the application: force:LightningQuickAction, force:hasRecordId, force:hasSObjectName

Would I be able to document this as a false positive for CSRF with the justification that this component does not have a URL?

  • Would it be possible to explain a little more on nature of the quick action and why is the dml needed? – codeyinthecloud Oct 31 '18 at 17:05
  • The resource that the user is redirected to expects a record to exist in the database. So this component creates the record and redirects to that resource. It's a bad design but if it safe then I'd rather not spend the time fixing it right now. Thanks for the help! – bafuda Oct 31 '18 at 17:54
  • Before inserting if you can confirm with user it wnt be breaking CSRF then. – Pranay Jaiswal Oct 31 '18 at 17:56
  • honestly Successfully performing a CSRF attack is not trivial. It requires the targeted user to visit the attack page while authenticated with the targeted service, which often requires coordinated deception on the part of the attacker (this is mostly commonly seen in phishing campaigns). Just show a confirmation before redirecting can help for now! more here – codeyinthecloud Oct 31 '18 at 17:58
  • I'll implement the confirmation before the DML & redirect just to be safe. thanks again! – bafuda Oct 31 '18 at 18:52
3

YES and NO, It can be little tricky! Even though the dml is happening on component load but which is still a click by a human intervention(because its a quick action) this would be a hard one to determine.

CSRF : In order to prevent CSRF attacks, do not invoke any server-side controller method that performs a DML operation automatically as the result of a page load. Specifically, do not invoke server-side DML controller method as onInit handlers, or afterRender handlers (if rendering is performed automatically on page load).

({
    doInit: function(cmp) {
        var action = cmp.get("c.updateField"); //vulnerable to CSRF
        [...]
        $A.enqueueAction(action);
       },
    handleClick: function(cmp, event) {
        var action = cmp.get("c.updateField"); //not vulnerable to CSRF
        [...]
        $A.enqueueAction(action);
       } 
})

The key is that the DML operation not be performed without an event stemming from human interaction, such as a click. CSRF only applies to server-side DML operations, not operations that update client-side component attributes.

Developers should be cautious about writing pages that take action based upon a user-supplied parameter like the id variable in the preceding example. A possible work-around is to insert an intermediate confirmation page before taking the action, to make sure the user intended to call the page. Other suggestions include shortening the idle session timeout for the organization and educating users to log out of their active session and not use their browser to visit other sites while authenticated

1

Adding few pointers to what codeyInTheCloud has said.

It's a good practice to not do DML in onLoad of page in VF and init method of lightning, but if there is a strong business use case and there is no way out then it is acceptable.

eg: You have to audit when a record is opened by a user, and how many times, then, in that case, we use a VF page or lightning component and do a dml on page load. There is always a risk with this but can be still mitigated if certain things are followed.

  1. Avoid Dynamic SOQL in Apex controller (https://developer.salesforce.com/docs/atlas.en-us.pages.meta/pages/pages_security_tips_soql_injection.htm) , if needed atleast sanitize the input received

  2. If doing delete or update of critical data, always ask for confirmation from end user, using modal or page messages.

Following these practices and giving a proper explanation to security team, you can get the app reviewed without hassels.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.