Generating code to validate input data

• US 20080126869A1
• Filed: 09/26/2006
• Published: 05/29/2008
• Est. Priority Date: 09/26/2006
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Wood, Matthew D., Ross, Benjamen E., Kraft, Tara
• Granted Patent: US 7,904,963 B2
• Time in Patent Office: Days
• US Class Current: 714/37
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

Input data is validated by generating code based on the input data. A schema is generated based on the input data indicating conditions for the input file. The schema may then be customized based on a type of application to consume the input data. A validator executable code is generated based on the schema and checks the input file for compliance with the conditions determined by the schema. Results of validation may be provided to the application in yes or no form, or as number of non-compliances. In the latter case, the application may decide to accept or reject the data based on predetermined non-compliance levels.

Claims

1. A method to be executed at least in part in a computing device for protecting an application against malformed input data, the method comprising:

defining a schema for a well-formed data file containing the input data;

generating executable code based on the schema;

validating the input data using the executable code; and

providing validation results to the application.

2. The method of claim 1, wherein the schema includes descriptions for at least one from a set of:

a structure of the input data, an expected value for the input data, and a restriction imposed by a relationship among the input data.

3. The method of claim 2, wherein the descriptions are included in the schema as a hierarchic structure of objects corresponding to data units within the data file.

4. The method of claim 1, further comprising:

retrieving instructions from a parser module for generating the executable code based on the schema.

5. The method of claim 4, wherein the parser module includes a set of instructions for generic data types and another set of instructions for custom data types.

6. The method of claim 1, wherein the validation results include one of acceptance and rejection of the input data.

7. The method of claim 1, wherein the validation results include a quantitative report and a qualitative report of validation errors.

8. The method of claim 7, further comprising:

accepting the input data according to a predetermined criterion based on at least one of the quantitative report and the qualitative report of validation errors.

9. The method of claim 1, further comprising:

receiving a rule for further validation of the input data;

injecting a code segment based on the received rule directly into the executable code.

10. The method of claim 9, wherein the rule includes one or more expressions that include at least one from a set of:

a value validation, a validation through navigation, and a call function for a predefined action.

11. The method of claim 1, further comprising:

defining the schema based on at least one of;

a format of the input data in the data file and a placement of the input data in the data file.

12. A system for protecting an application against malformed input data, comprising:

a validation engine configured to;

execute a validation code generator module that is arranged to generate executable validation code based on a schema defining a well-formed data file containing the input data and instructions from at least one parser module;

receive the input data;

execute the validation code to validate the input data; and

provide validation results to the application.

13. The system of claim 12, wherein the validation engine is one of:

an integrated part of the application, a separate program module, and a centralized network service.

14. The system of claim 12, wherein the schema is in eXtensible Mark-up Language (XML) format and the validation code is in C++ format.

15. The system of claim 12, further comprising a repair engine configured to repair a malformed portion of the data based on at least one of:

a type and a number of validation errors.

16. The system of claim 12, wherein the at least one parser module includes a core parser module configured to provide instructions for parsing the schema into the validation code and a custom parser module configured to provide file structure definitions for each component of the schema associated with a specific application, and wherein the core parser module, the custom parser module, and the validation code generator module are Dynamic Link Library (DLL) modules.

17. The system of claim 12, wherein the validation code generator is further configured to provide at least one helper function for writing a custom parser module to navigate the schema.

18. A computer-readable medium having computer executable instructions for validating data in an input file, the instructions comprising:

receiving a schema defining a well-formed data file containing input data;

receiving instructions from a validation parser module for parsing the schema into executable validation code

generating executable validation code;

validating the input data by executing the executable validation code on the input file; and

providing validation results to the application.

19. The computer-readable medium of claim 18, wherein the instructions further comprise:

the results include a number of validation errors and a severity level for each validation error.

20. The computer-readable medium of claim 18, wherein the input to the validation code is a path definition of the input file.