I'm developing a Drupal site for a government organisation and am required to fill in a security assessment form. The form asks for confirmation that the "application" (Drupal in this case) takes steps to mitigate against threats and attacks that can exist as a result of inadequate data validation and encoding, including form field manipulation, cookie manipulation, and HTTP header manipulation.

The specific questions asked are:

  • Are cookies validated?
  • Are HTTP headers (e.g. Referer and User-Agent) validated?

I can answer from the point of view of my own application (it uses and validates a couple of cookies, does no validation of HTTP headers). How should I answer in terms of what Drupal core does?

  • Validated against what, exactly? What does your organisation consider to be a "valid" referrer or user agent, or "valid" cookie? I guess there must be some real guidelines along with that request, if not, ask for them! If your policies are different from the 'norm' then Drupal probably doesn't already do what you need, but if you can be a bit more specific about what you consider to be valid or invalid data for referrers, user agents and cookies, it'll be easier to point you in the right direction to make changes – Clive May 15 '15 at 12:30
  • Thanks @Clive. Validation against malicious input, is probably the best way to put it. I have updated the question with some additional info from the relevant guidelines. – Frank H. May 15 '15 at 13:13
  • 1
    Thanks that's definitely clearer...from a cursory grep of Drupal 7 for HTTP_USER_AGENT and HTTP_REFERRER, it would appear Drupal has no validation in place for those server vars. Which is probably fair enough, since those are both notoriously untrustworthy headers that should usually be ignored anyway. If the data isn't reliable enough to believe in the first place, why bother validating it? Cookies will need a bit more investigation, will have a look later... – Clive May 15 '15 at 13:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.