Outsourcing the British High Commission, part 2

As an update to yesterdays post I thought I should share some big worries I have with this online application system for requesting UK visas for Nigerians.

As I was going through the process of entering the details on the form I used an apostrophe / single inverted comma (') in one of the fields, and got back an error message that rings 100dB Alarm Sirens in my head as a web developer with some experience.



The error message indicates that there is no validation done on user input to the system! This means a suitably skilled web developer, wearing their black crackers hat, could use this 'feature' to put code of their own into the script! I haven't done any further tests but trust me that this is an amateurs mistake.

I am using Mozilla Firefox to access the site and I can see that there is JavaScript code on the page to prevent the user entering ' on the form as well as some other characters, but because of bugs in the JavaScript code this does not work with Mozilla Firefox (at least the version I'm using, 1.5.0.7 on Debian GNU/Linux). This isn't the argument though as the server application should never rely on the client sending valid information. This is rule number one of web security! Accessing the site in Internet Explorer prevents you from entering ' at the keyboard.

My fictional friend William De'Ath Could be a useful person to test this out with.

Further details easily obtainable from the site show what scripting language to use and what operating system is running it.

I am thinking about who to contact to investigate this.

The JavaScript side works on Firefox for the UK based online application service, I haven't tried to circumvent this to see if that is susceptible too.

Outsourcing the British High Commission

I am helping someone apply for a visa to visit the UK and it looks like things have got simpler with on-line applications being accepted. While the Foreign & Commonweath Office in the UK Operates the online visa applications for a long list of countries through a service called visa4uk, for Nigeria applications are handled through a company based in India through a site called www.ukvac-ng.com and www.vfs.firm.in. Here is the Whois info on the domain:

VFS (India) Pvt. Ltd.
Amish Shah
Lincoln House, 17 Altamount Road Behind Indonesian Consulate,
Mumbai, Maharastra 400 036
IN
Email: amishs@visa-services.com

Registrar Name....: REGISTER.COM, INC.
Registrar Whois...: whois.register.com
Registrar Homepage: www.register.com

Domain Name: ukvac-ng.com

Created on..............: Tue, Dec 13, 2005
Expires on..............: Wed, Dec 13, 2006
Record last updated on..: Tue, Apr 04, 2006

Administrative Contact:
VFS (India) Pvt. Ltd.
Amish Shah
Lincoln House, 17 Altamount Road Behind Indonesian Consulate,
Mumbai, Maharastra 400 036
IN
Phone: 91-563-88628
Email: amishs@visa-services.com

I've looked at both online-application sites and they both seem similar in design, So I wonder why the FCO decided to outsource this setup when their own system could easily adapt?