CSC 2045 Week 5 Input Validation PDF

CSC 2045 MODERN C++ INPUT VALIDATION USING REGULAR EXPRESSIONS  OBJECTIVES AGENDA: WEEK 05 Conduct secure coding 1. Modern C++ practices for secure software 2. Top 10 Secure Coding Practices development...

CSC 2045 MODERN C++ INPUT VALIDATION USING REGULAR EXPRESSIONS  OBJECTIVES AGENDA: WEEK 05 Conduct secure coding 1. Modern C++ practices for secure software 2. Top 10 Secure Coding Practices development 3. Input Validation Defined Identify common software 4. What to do when input fails vulnerabilities 5. Input Validation Tips & Cheatsheet Understand allow-listing and 6. Allow and Deny Lists deny-listing approaches to 7. and std::string input validation 8. Demo Validate all user-input against a 9. Input & Regular Expressions strict, allow-list-based regular 10. Regular Expression Rules expression pattern 11. Steps for Regular Expressions MODERN C++ Modern C++ provides a lot of tools that help you write code more securely. There is NO technique or programming paradigm that can fully protect you from all errors. Do not solely rely on only one security method: use the combination of code-review, quality code, and decent tools. TOP 10 SECURE CODING PRACTICES (SEI) 1. Validate input. 7. Sanitize data sent to other systems. 2. Heed compiler warnings. 8. Practice defense in depth. 3. Architect and design for security policies. 9. Use effective quality assurance 4. Keep it simple. techniques. 5. Default deny. 10. Adopt a secure coding standard. 6. Adhere to the principle of 11. Define security requirements. least privilege. 12. Model threats.  INPUT VALIDATION DEFINED Any program input – such as a user typing at a keyboard or a network connection – can potentially be the source of security vulnerabilities and disastrous bugs. All input should be treated as potentially dangerous. It is always recommended to prevent attacks as early as possible in the processing of the user's (attacker's) request. Input validation can be used to detect unauthorized input before it is processed by the application. WHAT TO DO WHEN INPUT FAILS VALIDATION There are two major approaches: 1.recovering and continuing on recovering from an input validation failure implies that the input can be sanitized or This Photo by Unknown author is licensed under CC BY-SA. fixed—that is, that the problem that caused the failure can be solved programmatically. 2.failing the action and reporting an error. the major disadvantage of this approach is that the user experience is interrupted and any transaction in progress may be lost. This Photo by Unknown author is licensed under CC BY-NC-ND. INPUT VALIDATION TIPS & CHEATSHEET “All input is evil, until proven otherwise” Garbage IN Garbage Out Validate input that crosses trust boundaries Get input as C++ std::string and then validate and convert if need be Validate inputs against expected data: This Photo by Unknown author is licensed under CC BY-NC-ND. Format | Length | Type | Range ALLOW LIST Allow-list validation (also referred to as inclusion or positive validation) Allow-list validation is appropriate for all input fields provided by the user. Allow-list validation involves defining exactly what IS authorized or allowed, and everything else is NOT authorized or blocked. Use the allow-listing approach which compares input data against expected data formats, lengths, types and ranges. Any data that does not match the expected data patterns is considered malicious and should be safely rejected by the application Use allow list approach that lists all known good inputs that a system is allowed to accept but exclude everything else. DENY (BLOCK) LIST Deny-list validation (also known as block, exclusion or negative validation) Deny-listing requires that you know all possible attack patterns which is extremely difficult to perform correctly. It is a common mistake to use deny-list validation to try to detect possibly dangerous characters and patterns like the apostrophe ' character, the string 1=1, or the tag, but this is a massively flawed approach as it is trivial for an attacker to bypass such filters. Deny-list defines what is blocked and everything else if allowed. C++ AND STD::STRING (CPLUSPLUS) Strings are objects that represent sequences of characters. Declaring a std::string object (variable): Constructs the string object, and initializes its value depending on the constructor version use Performing std::string member function operations on the object Capacity Modifiers​ Iterators Other Element access Operations​ Non-member functions GETTING INPUT WITH STD::STRING Extracts a string from the input stream, storing the sequence in str, which is overwritten (the previous value of str is replaced). This function overloads operator>> to use whitespace as separators std::operator>>(std::string& str) Extracts characters from is and stores them into str until the delimitation character delim is found (or the newline character, '\n' std::getline(std::istream&, std::string& str) DEMO: STD::CIN & HANDLING INVALID INPUT In our GDB Classroom, Work through the tutorial and examples and always consider how users will misuse your program, especially around text input. For each point of text input, consider: 1. Could extraction fail? 2. Could the user enter more input than expected? 3. Could the user enter meaningless input? 4. Could the user overflow an input? 5. You can use if statements and boolean logic to test whether input is expected and meaningful. HOWTO: INPUT VALIDATION & REGULAR EXPRESSIONS Read the chapter sections noted below: o 5.1 Basics of input validation o 5.2. Input Validation Tools including Regular Expressions ▪ 5.2.1. Introduction to regular expressions ▪ 5.2.2. Using regular expressions for input validation ▪ 5.2.3. Regular expression denial of service (reDOS) attacks REGULAR EXPRESSION RULES Review the blog and demo: o https://www.modernescpp.com/index.php/regular- expressions/ STEPS FOR REGULAR EXPRESSIONS From the blog and demo: https://www.modernescpp.com/index.php/regular- expressions/ Using a regular expression typically consists of three steps. This holds for std::regex_search, and std::regex_match. 1. Define the regular expression. 2. Store the result of the search. 3. Analyze the result.