M04: Insufficient Input/Output Validation

📋 What Is It?

Insufficient Input/Output Validation occurs when mobile applications fail to properly validate, sanitize, or encode data received from users, servers, or other apps. This enables injection attacks, buffer overflows, and data corruption. Mobile apps must validate all inputs including user data, API responses, deep links, intents, and file uploads.

M04 OWASP Rank

65% Apps Affected

<3hrs Time to Exploit

⚠️ Common Exploits

SQL Injection: Inject SQL through unvalidated inputs
XSS in WebViews: Execute JavaScript in mobile WebViews
Path Traversal: Access files outside intended directories
Deep Link Injection: Malicious URLs trigger unintended actions
Intent Injection: Send malicious intents to Android components
Command Injection: Execute OS commands through inputs

🔴 Attack Flow

1. Attacker identifies input field/deep link
↓
2. Injects malicious payload (SQL, JavaScript, path)
↓
3. App processes input without validation
↓
4. Malicious code executes or data accessed
↓
5. BREACH: SQLi, XSS, or file access!

❌ Vulnerable Code

// Bad: SQL Injection (Android)
public User getUser(String username) {
    // VULNERABLE: Direct string concatenation
    String query = "SELECT * FROM users WHERE username = '" + username + "'";
    Cursor cursor = db.rawQuery(query, null);
    // username = "admin' OR '1'='1" bypasses authentication
}

// Bad: XSS in WebView (Android)
public void loadContent(String userInput) {
    WebView webView = findViewById(R.id.webview);
    // VULNERABLE: No sanitization
    webView.loadData("<html><body>" + userInput + "</body></html>", 
                     "text/html", "UTF-8");
    // userInput = "<script>malicious()</script>" executes JS
}

// Bad: Path Traversal (iOS)
func loadFile(_ filename: String) -> String? {
    // VULNERABLE: No path validation
    let path = documentsDirectory + "/" + filename
    return try? String(contentsOfFile: path)
    // filename = "../../etc/passwd" accesses system files
}

// Bad: Deep Link without validation (Android)
@Override
protected void onCreate(Bundle savedInstanceState) {
    Intent intent = getIntent();
    Uri data = intent.getData();
    
    // VULNERABLE: Trust deep link data
    String userId = data.getQueryParameter("user_id");
    loadUserProfile(userId);  // No validation!
}

// Bad: Command Injection (Android)
public void pingHost(String host) {
    // VULNERABLE: Direct command execution
    Runtime.getRuntime().exec("ping -c 1 " + host);
    // host = "8.8.8.8; rm -rf /" executes additional commands
}
                

✅ Secure Code

// Good: Parameterized queries (Android)
public User getUser(String username) {
    // Use prepared statements
    String query = "SELECT * FROM users WHERE username = ?";
    String[] args = {username};
    Cursor cursor = db.rawQuery(query, args);
    // SQL injection prevented by parameterization
}

// Good: Sanitize WebView content (Android)
public void loadContent(String userInput) {
    WebView webView = findViewById(R.id.webview);
    
    // Sanitize HTML to prevent XSS
    String sanitized = TextUtils.htmlEncode(userInput);
    webView.loadData("<html><body>" + sanitized + "</body></html>",
                     "text/html", "UTF-8");
    
    // Or use Content Security Policy
    webView.getSettings().setJavaScriptEnabled(false);
}

// Good: Path validation (iOS)
func loadFile(_ filename: String) -> String? {
    // Validate filename contains no path traversal
    guard !filename.contains("..") && !filename.contains("/") else {
        return nil
    }
    
    // Whitelist allowed filenames
    let allowedFiles = ["config.json", "data.txt"]
    guard allowedFiles.contains(filename) else {
        return nil
    }
    
    let path = documentsDirectory.appendingPathComponent(filename)
    return try? String(contentsOf: path)
}

// Good: Deep Link validation (Android)
@Override
protected void onCreate(Bundle savedInstanceState) {
    Intent intent = getIntent();
    Uri data = intent.getData();
    
    if (data != null) {
        // Validate scheme and host
        if (!"myapp".equals(data.getScheme()) || 
            !"trusted.com".equals(data.getHost())) {
            return;
        }
        
        // Validate and sanitize parameters
        String userId = data.getQueryParameter("user_id");
        if (userId != null && userId.matches("^[0-9]+$")) {
            loadUserProfile(userId);
        }
    }
}

// Good: Input validation, avoid exec (Android)
public void pingHost(String host) {
    // Validate input format (IP or hostname)
    if (!host.matches("^[a-zA-Z0-9.-]+$")) {
        throw new IllegalArgumentException("Invalid host");
    }
    
    // Use safe API instead of exec
    InetAddress address = InetAddress.getByName(host);
    boolean reachable = address.isReachable(5000);
}
                

✓ Prevention Checklist

Validate all inputs (user, API, deep links, intents)
Use parameterized queries for database operations
Sanitize data before displaying in WebViews
Implement whitelist validation for file paths
Validate deep link schemes and hosts
Use safe APIs instead of system commands
Implement input length and format restrictions
Encode outputs appropriately for context
Never trust data from external sources
Use security-focused validation libraries

🔍 Detection & Tools

Testing Tools:

Burp Suite OWASP ZAP MobSF Drozer Frida sqlmap

Static Analysis:

SonarQube Checkmarx Fortify Veracode FindBugs/SpotBugs

How to Test:

Test SQL injection with payloads: ' OR '1'='1, admin'--
Test XSS with: <script>alert(1)</script>
Test path traversal with: ../../../etc/passwd
Test deep links with malicious parameters
Fuzz inputs with special characters and long strings
Use Drozer to test exported Android components

🌍 Real-World Breaches

Uber (2016): SQL injection in mobile backend exposed rider data
Yahoo (2016): XSS vulnerability in mobile app allowed account takeover
Multiple Apps (2019): Deep link vulnerabilities enabled phishing attacks
Banking Apps (2018): Path traversal exposed sensitive files
E-commerce Apps (2020): Intent injection led to unauthorized purchases

📌 Quick Tips

DO NOT concatenate user input into SQL queries
DO NOT trust deep link or intent data
DO NOT execute system commands with user input
DO use parameterized queries for databases
DO validate all inputs with whitelists
DO sanitize outputs for display context

📜 Compliance

Related Standards:

PCI-DSS Requirement 6.5.1
OWASP Top 10 A03:2021 - Injection
NIST 800-53 SI-10
OWASP MASVS MSTG-PLATFORM-2
CWE CWE-89, CWE-79, CWE-22
ISO 27001 A.14.2.5

🔍 Insufficient Input/Output Validation