CWE-501 is a product that mixes trusted and untrusted data in the same data structure or structured message. It is not tied to one language, so any codebase can have it.
How it happens
MITRE describes a trust boundary as a line drawn through a program. On one side data is untrusted. On the other side it is assumed to be trustworthy. Validation is what lets data cross the line safely.
The violation happens when code blurs that line. If a request object holds both a user supplied field and a value your server computed, a later reader cannot tell which is which. In MITRE's words, combining the two in one structure makes it easier for programmers to mistakenly trust unvalidated data.
A familiar form is a session. Server-set values such as a role or an account id sit next to values copied from a form.
# Risky: user input lands in the same dict as trusted values
session["user_id"] = authenticated_user.id # trusted
session["display_name"] = request.form["name"] # untrusted
# later code treats everything in session as vetted
What an attacker gains
MITRE lists an access control bypass of a protection mechanism. If the attacker can get a value into the shared structure, downstream code may act on it as though it had passed validation.
How to find it
Static analysis can find some instances, mainly by tracking data flow from sources such as request parameters to places where the data is stored with trusted values. In review, look at every structure that holds both server and client data and ask who writes each field.
How to fix it
The record lists no formal mitigations. The principle in the description gives the fix.
- Keep trusted and untrusted data in separate structures.
- Validate at the boundary, then copy only the validated values across.
- Name things so the origin is clear, for example
raw_inputandvalidated.
validated_name = validate_display_name(request.form["name"])
session["display_name"] = validated_name # only after validation
Quick check
What does validation do at a trust boundary?
It lets data move from untrusted to trusted. Skipping it, or mixing the two kinds of data, removes that step.
