Improving Web Application Security: Threats and - CGISecurity

264 Part III: Building Secure Web ApplicationsConstrain, Then SanitizeStart by constraining input and check for known good data by validating for type,length, format, and range. Sometimes you also need to sanitize input and makepotentially malicious input safe. For example, if your application supports freeformatinput fields, such as comment fields, you might want to permit certain “safe”HTML elements, such as and , and strip out any other HTML elements. Thefollowing table summarizes the options that are available for constraining andsanitizing data:Table 10.1 Options for Constraining and Sanitizing DataRequirementType checksOptions.NET Framework type system. Parse string data, convert to a strong type, andthen handle FormatExceptions.Regular expressions. Use ASP.NET RegularExpressionValidator control orRegex class.Length checksRegular expressionsString.Length propertyFormat checksRegular expressions for pattern matching.NET Framework type systemRange checksASP.NET RangeValidator control (supports currency, date, integer, double, andstring data)Typed data comparisonsRegular ExpressionsYou can use regular expressions to restrict the range of valid characters, to stripunwanted characters, and to perform length and format checks. You can constraininput format by defining patterns that the input must match. ASP.NET provides theRegularExpressionValidator control and the Regex class is available from theSystem.Text.RegularExpressions namespace.If you use the validator controls, validation succeeds if the control is empty. Formandatory fields, use a RequiredFieldValidator. Also, the regular expressionvalidation implementation is slightly different on the client and server. On the client,the regular expression syntax of Microsoft JScript ® development software is used. Onthe server, System.Text.RegularExpressions.Regex syntax is used. Since JScriptregular expression syntax is a subset of System.Text.RegularExpressions.Regexsyntax, it is recommended that JScript regular expression syntax be used to yield thesame results on both the client and the server.