Prevent Parameter Pollution in Node.JS
Tags: hpp, security, parameterpollution, node
Published: 2023-09-12 11:58:22

---
title: Prevent Parameter Pollution in Node.JS
published: true
date: 2021-05-16 21:48:02 UTC
tags: hpp,security,parameterpollution,nodejs
canonical_url: https://levelup.gitconnected.com/prevent-parameter-pollution-in-node-js-f0794b4650d2
---

HTTP Parameter Pollution or HPP in short is a vulnerability that occurs due to passing of multiple parameters having the same name.

![](https://cdn-images-1.medium.com/max/1024/1*lp371Yuybrl_riEnTeImiw.png)
_Parameter Pollution_

#### What is Parameter Pollution?

**HTTP Parameter Pollution** or **HPP** in short is a vulnerability that occurs due to passing of multiple parameters having same name. There is no RFC standard on what should be done when passed multiple parameters.(Wikipedia)

#### How Node.JS (Express) Reacts to Parameter Pollution

There are various ways of passing parameters in order to cause a problem and we can see the list of some possible ways in this table:

![](https://cdn-images-1.medium.com/max/1024/1*HfJX_RFT3XDJ9UyLBY89DA.png)
_Different ways of passing parameters_

Now that we are cognizant of various forms and problems that someone can cause by passing parameters we can say that we must take it seriously. Let’s see how validators react to parameter pollution:

### Two Node.JS Validators Reaction to Parameter Pollution

#### 1-[**express-validator**](https://github.com/express-validator/express-validator)

This library is one of the most common Javascript libraries and it is built on top of the [validatorjs](https://github.com/validatorjs) library.

We have a simple express server that we want to send the email and after validating that we want to do something:

<iframe src="" width="0" height="0" frameborder="0" scrolling="no"><a href="https://medium.com/media/2bd7079f8e8a6be13f98360ffb59458a/href">https://medium.com/media/2bd7079f8e8a6be13f98360ffb59458a/href</a></iframe>

**What happens when we try to pollute the parameters?**

![](https://cdn-images-1.medium.com/max/1024/1*o53YN96EPoiQUl5gw0b0JA.png)
_Result of request_

As you can see if we pass the first parameter a valid email we can bypass the validation and guess what I have on my console (line 9 of the code)?

![](https://cdn-images-1.medium.com/max/1024/1*ox9_l115reUnWznlR9SXSw.png)
_Console Log Result_

Now we have an invalid email that might be saved into the database. Let’s hope that the attacker is sending I'm malware or something like <script>alert("I'm a happy hacker")</script> .

You might argue that we are going to send POST method and not get so this is the POST method example:

<iframe src="" width="0" height="0" frameborder="0" scrolling="no"><a href="https://medium.com/media/0c0439820a911fb2c5366d9149ec2cfb/href">https://medium.com/media/0c0439820a911fb2c5366d9149ec2cfb/href</a></iframe>

Let’s see what is the result this time:

![](https://cdn-images-1.medium.com/max/1024/1*Z1bWBHsz-vCr4dPBNDkpCA.png)
_Post Request HPP Result_

As you expect the email log is { email: [‘[test@gmail.com](mailto:test@gmail.com)’, “I’m the same malware” ] }

#### 2- [**Joi**](https://github.com/sideway/joi)

Joi is another popular validation library. Let’s see how Joi reacts in the same situation:

<iframe src="" width="0" height="0" frameborder="0" scrolling="no"><a href="https://medium.com/media/9ed0ab6a96f79b3b6feef981756ca26b/href">https://medium.com/media/9ed0ab6a96f79b3b6feef981756ca26b/href</a></iframe>

**Let’s see the result**

![](https://cdn-images-1.medium.com/max/1024/1*MFvWLJlB6H-T3UCrb_8f-Q.png)
_Joi validation result_

As we can see **Joi** understands that this is not a string. Also if we use **validator.js** directly we are going to see a result like this and the problem of the former examples was **express-validator.**

### How can we prevent parameter pollution?

We have two ways:

- **Using a library**
- **Implement our own function**

There is a useful library(unfortunately it seems that it is not maintained regularly) called [**hpp**](https://github.com/analog-nico/hpp)

Using it is a walk in the park and we can use it by adding it as a middle-ware to our express app:

```
app.use(hpp());
```

After adding this line, if we pass a parameter more than once it changes the query to this:

```
GET /search?firstname=John&firstname=Alice&lastname=Doe

=>

req: {
    query: {
        firstname: 'Alice',
        lastname: 'Doe',
    },
    queryPolluted: {
        firstname: ['John', 'Alice']
    }
}
```

It moves that parameter to queryPolluted and takes the last value.

Also you can add an exception since sometimes we want to pass an array.

#### What can we implement to prevent Parameter Pollution?

let’s implement a simple middle-ware:

<iframe src="" width="0" height="0" frameborder="0" scrolling="no"><a href="https://medium.com/media/e94c77c3b8aa0f04d336392fd5e106b1/href">https://medium.com/media/e94c77c3b8aa0f04d336392fd5e106b1/href</a></iframe>

**hppProtector** is the middleware that is accountable to handle hpp. We simply iterate over the parameters and if the type is not string we check that, if the type is array we are choosing the first one(We could choose the last one too), if the type is object we send a bad request error because the user is sending something like this: email[as][ds]=something . **_This is just a simple example, do not rely on that._**

Let’s see what happens when we send requests:

![](https://cdn-images-1.medium.com/max/1024/1*MbIzgF5BTImw6a6NQnAySw.png)
_Simple HPP Implementation Result_

In this case, the parameter generates an object and we send bad parameters error.

Let’s send a parameter more than once:

![](https://cdn-images-1.medium.com/max/1024/1*YBui0Y-AeTEKaEoP6ripgw.png)
_Passing One Parameter more than once to our HPP Implementation_

The result of req.query.email is test@gmail.com since we use the first element of the array.

### Summary

Parameter Pollution is a vulnerability that occurs due to passing of multiple parameters having same name. Some validation libraries are vulnerable to this kind of attack so we should handle this attacks using a library or our own implementation.

[Nodejs Security - OWASP Cheat Sheet Series](https://cheatsheetseries.owasp.org/cheatsheets/Nodejs_Security_Cheat_Sheet.html)

* * *