Rich Web application input validation

• US 20070022119A1
• Filed: 07/22/2005
• Published: 01/25/2007
• Est. Priority Date: 07/22/2005
• Status: Active Grant

• Current Assignee: Daedalus Blue LLC
• Original Assignee: International Business Machines Corporation
• Inventors: Roy, Patrick, Masson, Matt
• Granted Patent: US 7,542,957 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload

Abstract

Method and system to build rich input validation rules to address values not previously validated by type based rules or regular expressions available in current validation engines. These new validation rules have a rich set of ordered validation rule primitives (VRPs) with acceptance VRP or rejection VRP, thus the new validation rules have capabilities to handle complex data values. Also disclosed are method and system to build a validation rule applied to data elements defined using a Perl regular expression.

Claims

1. A method for validating a request to an application, the request having a data comprising the steps of:

a) creating a validation engine comprising a validation logic, said validation logic comprising a rich validation rule, said rich validation rule using a plurality of ordered validation rule primitives (VRPs), said plurality of VRPs being selected from a group consisting of an acceptance VRP, a rejection VRP, and a combination thereof;

b) loading said rich validation rule;

c) applying said rich validation rule to the data, whereby the data is accepted if at least one of said acceptance VRPs succeeds and all of said rejection VRPs fail; and

d) sending the request to the application.

3. The method according to claim 1, wherein said validation engine resides in an application firewall.

4. The method according to claim 1, wherein said VRP is validation engine built-in validation logic, validation engine custom validation function, or Perl regular expression.

5. The method according to claim 4, wherein said built-in validation logic uses a well-known named VRP, wherein said built-in validation logic is further customized by modifying said named VRP.

6. The method according to claim 4, wherein said custom validation logic is added to said validation engine as an external code module.

7. The method according to claim 1, wherein said validation engine serves the application, and provides validation logic customized to the application.

8. The method according to claim 1, wherein said VRP is a list of characters.

9. The method according to claim 1, wherein said VRP is defined and referenced by name.

10. The method according to claim 1, wherein said VRP is flagged to override the logic of the VRPs that follows said VRP.

11. The method according to claim 1, wherein said VRP is used to modify the data used by VRPs that follows said VRP.

12. The method according to claim 1, wherein the application is a Web application.

2. A method for validating a request to an application, the request having a data comprising the steps of:

a) creating a validation engine comprising a validation logic, said validation logic comprising a validation rule, said validation rule corresponding to a defined plurality of data elements;

b) loading said validation rule;

c) applying said validation rule to said data elements; and

d) sending said request to the application.

13. The method according to claim 2, wherein said plurality of data elements comprises parameter names of the request, said parameter names being associated with their value.

14. The method according to claim 2, wherein said plurality of data elements are Perl regular expression.

15. The method according to claim 13, wherein said validation rule is a global rejection rule applying to all parameter names and values.

16. The method according to claim 15, further comprising the step of overriding the global rejection rule by a second rule.

17. The method as claimed in claim 15, wherein the said global rejection rule comprises a list of well-known values and characters used in security exploits.

18. The method as claimed in claim 2, wherein an XPath expression is used to identify said plurality of data elements in an XML request.

19. The method according to claim 2, wherein said plurality of data elements are dynamically defined by communication between the application and an application firewall.

20. The method according to claim 2, wherein the application is a Web application.

21. A storage medium readable by a computer encoding a computer program for execution by the computer to carry out a method for validating a request to an application, the computer program comprising:

a) code means for creating a validation engine comprising a validation logic, said validation logic comprising a rich validation rule, said rich validation rule using a plurality of ordered validation rule primitives (VRPs), said plurality of VRPs being selected from a group consisting of an acceptance VRP, a rejection VRP, and a combination thereof;

b) code means for loading said rich validation rule;

c) code means for applying said rich validation rule to the data, whereby the data is accepted if at least one of said acceptance VRPs succeeds and all of said rejection VRPs fail; and

d) code means for sending the request to the application.

23. The storage medium according to claim 21, wherein said validation engine resides in an application firewall.

24. The storage medium according to claim 21, wherein said VRP is validation engine built-in validation logic, validation engine custom validation function, or Perl regular expression.

25. The storage medium according to claim 24, wherein said built-in validation logic uses a well-known named VRP, wherein said built-in validation logic is further customized by modifying said named VRP.

26. The storage medium according to claim 24, wherein said custom validation logic is added to said validation engine as an external code module.

22. A storage medium readable by a computer encoding a computer program for execution by the computer to carry out a method for validating a request to an application, the computer program comprising:

a) code means for creating a validation engine comprising a validation logic, said validation logic comprising a validation rule, said validation rule corresponding to a defined plurality of data elements;

b) code means for loading said validation rule;

c) code means for applying said validation rule to the data; and

d) code means for sending said request to the application.

27. The storage medium according to claim 22, wherein said plurality of data elements comprises parameter names of the request.

28. The storage medium according to claim 22, wherein said plurality of data elements are Perl regular expression.

29. The storage medium according to claim 27, wherein said validation rule is a global rejection rule applying to all parameter values.

30. The storage medium according to claim 29, further comprising the step of overriding the global rejection rule by a second rule.

31. The storage medium according to claim 29, wherein the said global rejection rule comprises a list of well-known values and characters used in security exploits.