Improving Web Application Security: Threats and - CGISecurity

328 Part III: Building Secure Web ApplicationsLoosely Typed ParametersIf you use string parameters or byte arrays to pass arbitrary data, you lose many ofthe benefits of the .NET Framework type system. You must parse the input datamanually to validate it because the auto-generated WSDL simply describes theparameters as string input of type xsd:string. You need to programmatically checkfor type, length, format, and range as shown in the following example.[WebMethod]public void SomeEmployeeFunction(string dateofBirth, string SSN){. . .// EXAMPLE 1: Type check the datetry{DateTime dt = DateTime.Parse(dateofBirth).Date;}// If the type conversion fails, a FormatException is throwncatch( FormatException ex ){// Invalid date}}// EXAMPLE 2: Check social security number for length, format, and rangeif( !Regex.IsMatch(empSSN,@"\d{3}-\d{2}-\d{4}",RegexOptions.None)){// Invalid social security number}XML DataIn a classic business-to-business scenario, it is common for consumers to pass XMLdata that represents business documents such as purchase orders or sales invoices.The validity of the input data must be programmatically validated by the Webmethod before it is processed or passed to downstream components.The client and the server have to establish and agree on a schema that describesthe XML. The following code fragment shows how a Web method can use theSystem.Xml.XmlValidatingReader class to validate the input data, which, in thisexample, describes a simple book order. Notice that the XML data is passed througha simple string parameter.