CSC 1029 Input Validation Quiz

CSC 1029 Input Validation

• Objectives: Identify and describe secure coding implementation. Apply secure coding principles based on industry coding standards. Identify common software vulnerabilities.

• Agenda (Week 09):

  • Input Validation Definitions
  • Input Validation (Format, Length, Type, Range)
  • Allow List and Deny List
  • Handling input errors
  • Demo
  • TODO
  • Resources for Help

OWASP Input Validation Cheat Sheet

• Review the article to define:
  • Syntactic Validation
  • Semantic Validation
  • Allow List
  • Block (Deny) List

Secure Implementation Overview

• Microsoft noted only two types of security implementation issues:
  • Input validation
  • Everything else

Input Validation Defined

• Any program input (e.g., user typing, network connection) can be a source of security vulnerabilities and bugs.
• Treat all input as potentially dangerous.
• Prevent attacks as early as possible in processing user requests.
• Use input validation to detect unauthorized input before processing.

What is Input Validation Attack?

• An attacker deliberately enters malicious input to confuse an application and cause unplanned actions.
• Malicious input can include code, scripts, and commands that exploit vulnerabilities if not validated correctly.

Input Validation: Format/Syntactic

• Syntactic validation enforces correct syntax of structured fields (e.g., SSN, dates, currency symbols).
• Format check ensures data is in a specified format (template), like mm/dd/yyyy for dates.
• Input mask uses special characters to indicate where specific characters can be typed.

Input Validation: Length/Semantic

• Semantic validation ensures data correctness in a business context (e.g., start date before end date, price within range).
• Length checking ensures variables have the appropriate length (e.g., US phone numbers have 10 digits).

Input Validation: Type

• Check if the data type is correct (e.g., numeric, positive number).
• Check data size to verify string lengths and numeric accuracy (e.g., integer size).
• Often recommended to initially enter data as a string and then validate before converting it to another data type.

Input Validation: Range

• Range checking ensures numbers are within a specific range (e.g., months 1-12).
• Reasonable checking verifies values match expectations (e.g., age between 16 and 100).

Allow List

• Allow list validation (also called inclusion or positive validation) is appropriate for all user-provided input.
• It defines what input is authorized, and everything else is blocked.
• Compare input data against expected formats, lengths, types, and ranges.
• Reject any data that doesn't match.

Deny List/Block List

• Deny list validation (also called exclusion or negative validation) requires knowledge of all possible attack patterns (difficult).
• It's a common mistake to use a deny list to try detecting dangerous characters.
• It is a flawed approach as it is easy for attackers to bypass filters.
• It defines what is blocked, with everything else allowed.

Input Validation Format & Length Demo

• "All input is evil, until proven otherwise."
• Garbage in, garbage out.
• Validate input that crosses trust boundaries.
• Validate inputs against expected data: format, length, type, range.

Input Validation Type & Range Demo

• Verify data content matches expected type (e.g., a ZIP code).
• Ensure data contains only expected characters for the data type (e.g., allowed punctuation in a name).

Input Validation Defense-in-Depth

• Input validation is a valuable security tool.
• It should be part of a broader defense-in-depth strategy.
• Multiple layers of defense are necessary for overall application security.

What to Do When Input Fails

• Recovery and Continuing: Recover from input validation failure by sanitizing or fixing the input problem programmatically.
• Failing the Action and Reporting an Error: Disadvantage is that the user experience is interrupted and any in-progress transaction may be lost.

References

• Microsoft Secure Implementation Principles
• Cybersecurity Modules: Security Injections
• Input Validation Cheat Sheet
• Application Security Terminology
• Science Direct - Input validation

TODO

• Post weekly discussion question and research solution to D2L.
• Complete Week 09 Content Module in D2L to 100%.

Help/Questions

• Student Office Hours (by appointment or drop-in)
• Email: [email protected]
• RRCC On-Campus Tutoring
• 24/7 online tutoring (via D2L)

Test your knowledge on input validation principles, secure coding implementation, and common software vulnerabilities as covered in CSC 1029. This quiz will guide you through key concepts like Allow List, Deny List, and error handling techniques. Prepare for secure coding best practices based on industry standards.