Rich Web application input validation

• US 7,542,957 B2
• Filed: 07/22/2005
• Issued: 06/02/2009
• Est. Priority Date: 07/22/2005
• Status: Active Grant

• Current Assignee: Daedalus Blue LLC
• Original Assignee: International Business Machines Corporation
• Inventors: Roy, Patrick, Masson, Matt
• Primary Examiner(s): Holmes; Michael B
• Application Number:
  US11/187,268
• Publication Number:
  US 20070022119A1
• Time in Patent Office: 1,411 Days
• Field of Search: None
• US Class Current: 706/47
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

Method to build rich input validation rules to address values not previously validated by type based rules or regular expressions available in current validation engines. These new validation rules have a rich set of ordered validation rule primitives (VRPs) with acceptance VRP or rejection VRP, thus the new validation rules have capabilities to handle complex data values. Also disclosed is method to build a validation rule applied to data elements defined using a Perl regular expression.

Claims

1. A method for validating a request to a Web application, the request having a data, the method comprising:

creating a validation engine in a programmable processor, the validation engine comprising a validation logic, said validation logic comprising a rich validation rule, said rich validation rule using a plurality of ordered validation rule primitives (VRPs), said plurality of VRPs being selected from a group consisting of an acceptance VRP, a rejection VRP, and a combination thereof;

loading said rich validation rule;

applying said rich validation rule to the data, whereby the data is accepted if at least one of said acceptance VRPs succeeds and all of said rejection VRPs fail; and

sending the request to the Web application.

3. The method according to claim 1, wherein said validation engine resides in an application firewall.

4. The method according to claim 1, wherein said VRP is validation engine built-in validation logic, validation engine custom validation function, or Perl regular expression.

5. The method according to claim 4, wherein said built-in validation logic uses a well-known named VRP, wherein said built-in validation logic is further customized by modifying said named VRP.

6. The method according to claim 4, wherein said custom validation logic is added to said validation engine as an external code module.

7. The method according to claim 1, wherein said validation engine serves the Web application, and provides validation logic customized to the Web application.

8. The method according to claim 1, wherein said VRP is a list of characters.

9. The method according to claim 1, wherein said VRP is defined and referenced by name.

10. The method according to claim 1, wherein said VRP is flagged to override the logic of the VRPs that follows said VRP.

11. The method according to claim 1, wherein said VRP is used to modify the data used by VRPs that follows said VRP.

12. The method according to claim 1, wherein the Web application is an engine creating Web pages from application logic, stored data, and user input.

2. A method for validating a request to a Web application, the request having a data comprising:

creating a validation engine in a programmable processor, the validation engine comprising a validation logic, said validation logic comprising a validation rule, said validation rule corresponding to a defined plurality of data elements;

loading said validation rule;

applying said validation rule to said data elements; and

sending said request to the Web application.

13. The method according to claim 2, wherein said plurality of data elements comprises parameter names of the request, said parameter names being associated with their value.

14. The method according to claim 2, wherein said plurality of data elements are Perl regular expression.

15. The method according to claim 13, wherein said validation rule is a global rejection rule applying to all parameter names and values.

16. The method according to claim 15, further comprising the step of overriding the global rejection rule by a second rule.

17. The method as claimed in claim 15, wherein the said global rejection rule comprises a list of well-known values and characters used in security exploits.

18. The method as claimed in claim 2, wherein an XPath expression is used to identify said plurality of data elements in an XML request.

19. The method according to claim 2, wherein said plurality of data elements are dynamically defined by communication between the Web application and an application firewall.

20. The method according to claim 2, wherein the Web application is an engine creating Web pages from application logic, stored data, and user input.

21. A storage device readable by a computer encoding a computer program for execution by the computer to carry out a method for validating a request to a Web application, the computer program comprising:

code means for creating a validation engine comprising a validation logic, said validation logic comprising a rich validation rule, said rich validation rule using a plurality of ordered validation rule primitives (VRPs), said plurality of VRPs being selected from a group consisting of an acceptance VRP, a rejection VRP, and a combination thereof;

code means for loading said rich validation rule;

code means for applying said rich validation rule to the data, whereby the data is accepted if at least one of said acceptance VRPs succeeds and all of said rejection VRPs fail; and

code means for sending the request to the Web application.

23. The storage device according to claim 21, wherein said validation engine resides in an application firewall.

24. The storage device according to claim 21, wherein said VRP is validation engine built-in validation logic, validation engine custom validation function, or Perl regular expression.

25. The storage device according to claim 24, wherein said built-in validation logic uses a well-known named VRP, wherein said built-in validation logic is further customized by modifying said named VRP.

26. The storage device according to claim 24, wherein said custom validation logic is added to said validation engine as an external code module.

22. A storage device readable by a computer encoding a computer program for execution by the computer to carry out a method for validating a request to a Web application, the computer program comprising:

code means for creating a validation engine comprising a validation logic, said validation logic comprising a validation rule, said validation rule corresponding to a defined plurality of data elements;

code means for loading said validation rule;

code means for applying said validation rule to the data; and

code means for sending said request to the Web application.

27. The storage device according to claim 22, wherein said plurality of data elements comprises parameter names of the request.

28. The storage device according to claim 22, wherein said plurality of data elements are Perl regular expression.

29. The storage device according to claim 27, wherein said validation rule is a global rejection rule applying to all parameter values.

30. The storage device according to claim 29, further comprising the step of overriding the global rejection rule by a second rule.

31. The storage device according to claim 29, wherein the said global rejection rule comprises a list of well-known values and characters used in security exploits.