mitigations.md

Mitigation Strategies Analysis for nikic/fastroute

Mitigation Strategy: Post-Match Input Validation and Sanitization (within FastRoute Handlers)

• Description:

  1. Access Route Parameters: Within your route handler functions (the callbacks you provide to fast-route), access the captured route parameters. These are typically provided as an array (e.g., $vars in the examples).
  2. Type Casting: Cast each parameter to its expected data type within the handler. For example: $id = (int) $vars['id'];. This is done after fast-route has matched the route.
  3. Range/Length Checks: Implement checks for numeric and string parameters within the handler, based on your application's requirements. Example: if ($id < 1 || $id > 1000) { /* Handle invalid input */ }.
  4. Whitelist Validation (if applicable): If a parameter should only accept specific values, use a whitelist check within the handler. Example: if (!in_array($parameter, $allowedValues)) { /* Handle invalid input */ }.
  5. Sanitization: Sanitize the input within the handler, based on its intended use (e.g., htmlspecialchars() for HTML output). This is crucial even after fast-route's regex matching.
  6. Error Handling: If validation/sanitization fails within the handler, return an appropriate HTTP error code (e.g., 400, 422) and a user-friendly message.
  7. Validation Library (Optional): Consider using a validation library within the handler for complex rules.

• Threats Mitigated:

  • Business Logic Errors (Severity: Variable): Prevents unexpected values from reaching your application logic, even if they match the route's regex.
  • Parameter Tampering (Severity: High): Prevents attackers from manipulating parameter values to access unauthorized resources.
  • Denial of Service (DoS) (Severity: Medium): Length limits can help mitigate some DoS attacks.
  • Indirectly mitigates XSS and SQL Injection: While not directly preventing these, proper validation and sanitization within the handler are essential steps in preventing them, in conjunction with other techniques (prepared statements, output escaping). fast-route alone cannot prevent these.

• Impact:

  • Business Logic Errors: Risk significantly reduced.
  • Parameter Tampering: Risk significantly reduced.
  • DoS: Risk partially mitigated.
  • XSS/SQL Injection: Indirectly contributes to risk reduction.

• Currently Implemented: Partially. Type casting in app/Controllers/UserController.php for the id parameter.

• Missing Implementation:

  • Range checks missing for id in app/Controllers/UserController.php.
  • Length limits missing for string parameters.
  • No dedicated validation library.

Mitigation Strategy: ReDoS Protection (Route Regex Design)

• Description:

  1. Regex Review: Carefully review all regular expressions used in your route definitions (e.g., in routes.php). This is a direct interaction with fast-route.
  2. Regex Simplification: Rewrite any complex or potentially vulnerable regular expressions in your route definitions to be simpler and more specific. Avoid nested quantifiers and overlapping alternations. This is the core of ReDoS mitigation within the context of fast-route.
  3. Input Length Limits (Post-Routing): Enforce length limits on individual route parameters within your handlers, as described in the previous strategy. This is a combined strategy, leveraging both fast-route's matching and your handler logic.

• Threats Mitigated:

  • Regular Expression Denial of Service (ReDoS) (Severity: High): Directly addresses ReDoS by improving the regexes used by fast-route.

• Impact:

  • ReDoS: Risk significantly reduced by careful regex design.

• Currently Implemented: Input length limits (post-routing) are partially implemented.

• Missing Implementation:

  • Thorough review and simplification of route regexes in routes.php is not done.

Mitigation Strategy: Secure Dispatcher Usage and Updates (of FastRoute)

• Description:

  1. Dispatcher Choice: Select the appropriate fast-route dispatcher (e.g., GroupCountBased) based on your needs. This is a direct configuration of fast-route.
  2. Testing (FastRoute Usage): Write unit and integration tests that specifically test your use of fast-route. Test valid and invalid routes, edge cases, and potentially malicious inputs as they relate to your route definitions.
  3. Updates: Keep fast-route itself updated to the latest version using Composer. This ensures you have the latest security fixes within the library.
  4. Dependency Audit: Regularly run composer audit to check for known vulnerabilities in fast-route and its dependencies.

• Threats Mitigated:

  • Unknown Vulnerabilities in Dispatcher Implementation (Severity: Low to Medium): Staying updated and testing your usage reduce the risk.
  • Known Vulnerabilities in Dependencies (Severity: Variable): composer audit and updates help mitigate vulnerabilities in the library itself.

• Impact:

  • Unknown Vulnerabilities: Risk reduced.
  • Known Vulnerabilities: Risk significantly reduced.

• Currently Implemented: GroupCountBased dispatcher is used. Basic unit tests exist. composer update is run periodically.

• Missing Implementation:

  • Comprehensive testing of fast-route usage is lacking.
  • composer audit is not in the CI/CD pipeline.

Mitigation Strategy: Avoid Dynamic Routes from User Input (in FastRoute Configuration)

• Description:

  1. Identify Dynamic Route Generation: Review your code to ensure you are not generating fast-route definitions dynamically based on untrusted user input.
  2. Refactor to Static Routes: If found, refactor to use only static route definitions within your routes.php (or equivalent) file. This directly relates to how you configure fast-route.
  3. Constrained Alternatives (Avoid if Possible): If user-configurable routing is unavoidable, use extremely constrained and validated methods, and ensure they do not allow arbitrary regex or code injection into your fast-route configuration.

• Threats Mitigated:

  • Code Injection (Severity: Critical): Eliminates the risk of injecting code into your routing logic.
  • ReDoS (Severity: High): Prevents user-supplied regexes from causing ReDoS.
  • Unpredictable Behavior (Severity: High): Avoids unexpected routing behavior.

• Impact:

  • Code Injection: Risk eliminated.
  • ReDoS: Risk significantly reduced.
  • Unpredictable Behavior: Risk significantly reduced.

• Currently Implemented: The application does not use dynamic route generation.

• Missing Implementation: N/A

Mitigation Strategy: Secure Error Handling (of FastRoute Dispatch Results)

• Description:

  1. Custom NOT_FOUND Handler: Implement a custom handler within your fast-route setup for FastRoute\Dispatcher::NOT_FOUND. This handler should return a 404 and a user-friendly message, without revealing internal details.
  2. Custom METHOD_NOT_ALLOWED Handler: Implement a custom handler within your fast-route setup for FastRoute\Dispatcher::METHOD_NOT_ALLOWED. Return a 405, optionally include an Allow header, and provide a user-friendly message.
  3. Exception Handling (Around FastRoute Dispatch): Wrap your fast-route dispatch call (e.g., $dispatcher->dispatch(...)) in a try-catch block to handle any exceptions thrown by fast-route itself. Log the exception securely and return a generic 500 error to the user.

• Threats Mitigated:

  • Information Disclosure (Severity: Low to Medium): Prevents fast-route error details from being exposed to the user.

• Impact:

  • Information Disclosure: Risk significantly reduced.

• Currently Implemented: Custom NOT_FOUND and METHOD_NOT_ALLOWED handlers are implemented. A global exception handler is in place.

• Missing Implementation: The METHOD_NOT_ALLOWED handler does not include the Allow header.