CSC 2045: C++ Input Validation

Modern C++ Input Validation Using Regular Expressions

• Course: CSC 2045
• Topic: Secure coding practices in Modern C++ utilizing regular expressions for input validation

Objectives

• Conduct secure coding practices for secure software development
• Identify common software vulnerabilities
• Understand allow-listing and deny-listing approaches to input validation
• Validate all user input against a strict, allow-list-based regular expression pattern

Agenda

• Modern C++ Overview
• Top 10 Secure Coding Practices (Validate input, Heed compiler warnings, Architect and design for security policies, Keep it simple, Default deny, Adhere to least privilege, Sanitize data, Practice defense in depth, Use effective quality assurance techniques, Adopt a secure coding standard, Define security requirements, Model threats)
• Input Validation Defined
• Handling Input Validation Failures (recovering/failing)
• Input Validation Tips & Cheatsheet
• Allow and Deny Lists
• std::string and related mechanisms (accessing strings with std::cin and std::getline)
• Input & Regular Expressions
• Regular Expression Rules
• Steps for Regular Expressions

Input Validation Defined

• Any program input can be a source of security vulnerabilities.
• All input should be treated as potentially dangerous.
• Preventing attacks early, in the input processing phase, is crucial.
• Input validation can detect unauthorized input before the application processes it.

What to Do When Input Fails Validation

• Recover and Continue: If possible, sanitize or fix the invalid input so processing can continue. This approach often involves modifying the input to conform to expectations.
• Failing the Action and Reporting an Error: If the invalid input cannot be fixed, halt the action and report the error to the user. This approach is crucial for maintaining application integrity and user experience, especially in cases where corrupted or malformed data is detected.

Input Validation Tips & Cheatsheet

• "All input is evil, until proven otherwise."
• Garbage In = Garbage Out, and validate inputs at boundaries.
• Use std::string and convert if needed to ensure correct data types.
• Validate input against expected data (format, length, type, range) before processing it.

Allow Lists

• Allow-list validation defines authorized input.
• Reject any input not on the allow list (anything unexpected). This method is highly recommended to prevent dangerous inputs from entering the application.

Deny Lists

• Deny-list validation defines blocked input. This is less secure than allow-listing. It can be vulnerable to attack vectors that weren't previously identified. Preventing unexpected or harmful input is less secure.
• Knowing all possible attacks is extraordinarily difficult.
• Using deny lists alone is often insufficient for protecting against security threats.

C++ and std::string

• Strings are sequences of characters.
• std::string object (variable) declaration.
• Using std::string member functions for various operations (e.g., capacity, modifiers, iterators, element access, non-member functions).
• Retrieving input using std::operator>> for simple input and std::getline when whitespace is not the delimiter.

Handling Invalid Input

• Always consider how users may misuse the program, especially with text input, which might include invalid or unexpected input.
• For each input point, validate for:
  • Extraction failure from input streams
  • Input exceeding expected size constraints
  • Meaningless input
  • Input overflow errors to prevent buffer overruns
  • Ensure validation occurs consistently at multiple points in the application

Regular Expressions

• Regular expressions are a powerful tool for pattern matching which can be used to perform input validation and other verification actions.
• Review the blog and demo to learn regular expression rules.
• Using regular expressions typically involves three steps:
  • Define the regular expression (pattern) using specific characters and symbols.
  • Store the result of the match search using functions like std::regex_search or std::regex_match for string-based validation, and matching, checking if a string matches the pattern.
  • Analyze the result to determine whether the input conforms to the pattern, and take necessary actions based on the results for appropriate handling.

Additional Information

• The supplied blog post URL (https://www.modernescpp.com/index.php/regular-expressions/) provides further details on using regular expressions for input validation and other related topics.
• Further examples and rules for Regular Expressions are found at the URL.
• Regular expressions can be used to enforce specific formats, lengths, and other constraints on user input.
• Regular expression denial of service (ReDoS) attacks exploit regular expressions to consume excessive resources. Use regular expressions carefully to prevent this type of attack in your applications.