Improving Web Application Security: Threats and - CGISecurity

Chapter 12: Building Secure Web Services 327In the preceding example, the .NET Framework type system performs type checksautomatically. To validate the range of characters that are supplied through the namefield, you can use a regular expression. For example, the following code shows howto use the System.Text.RegularExpressions.Regex class to constrain the possiblerange of input characters and also to validate the parameter length.if (!Regex.IsMatch(name, @"[a-zA-Z'.`-´\s]{1,40}")){// Invalid name}For more information about regular expressions, see the “Input Validation “ sectionin Chapter 10, “Building Secure ASP.NET Pages and Controls.” The followingexample shows a Web method that accepts a custom Employee data type.using Employees; // Custom namespace[WebMethod]public void CreateEmployee(Employee emp) { ... }The consumer needs to know the XSD schema to be able to call your Web service. Ifthe consumer is a .NET Framework client application, the consumer can simply passan Employee object as follows:using Employees;Employee emp = new Employee();// Populate Employee fields// Send Employee to the Web servicewsProxy.CreateEmployee(emp);Consumer applications that are not based on the .NET Framework must construct theXML input manually, based on the schema definition provided by the organizationresponsible for the Web service.The benefit of this strong typing approach is that the .NET Framework parses theinput data for you and validates it based on the type definition. However, inside theWeb method you might still need to constrain the input data. For example, while thetype system confirms a valid Employee object, you might still need to performfurther validation on the Employee fields. You might need to validate that anemployee’s date of birth is greater than 18 years ago. You might need to use regularexpressions to constrain the range of characters that can be used in name fields, andso on.For more information about constraining input, see the “Input Validation” section inChapter 10, “Building Secure ASP.NET Pages and Controls.”