cyphersec A blog about Web Application Security and .NET development best practices

24Aug/090

Cyphersec.ValidationFramework an object oriented validation library

image

ValidationFramework is a Microsoft .NET Class library built to help developers writing a more secure and consistent code without the drama of dealing with regular expressions.

Its architecture enables developers to extend its behaviour creating new validation logics. A validation logic is basically “how” the code will get validated against a predetermined set of rules. In this initial version only Regular expressions are supported.

Being object oriented it’s an important aspect making easy to understand and implement. In software security there’s a rule: “Never trust the client”. With this in mind an application developer could easily validate any external input with this library.

A UserInput object it’s a single logical unit that exposes three public properties, which are: Description, Value, DataType. Description could be any string that will help you associate any input with an user-friendly name. DataType it’s a classification that tell the library how how to evaluate the object.

Depending on the UserInput’s DataType different validation rules will be used. This version supports the following DataTypes:

  • First Name
  • Last Name
  • UK Date Format
  • US Telephone Number
  • Address
  • UK Post Code
  • US Zip Code
  • Email
  • URL
  • Network Address
  • Percentage
  • US Currency
  • Roman Numerals
  • TextEstensions (c:\file.txt || c:\folder\sub folder\file.txt || \\network\folder\file.txt)
  • Days of Week
  • Social Security Number
  • Credit Card (Generic)
  • Credit Card American Express
  • Credit Card Diners Club
  • Credit Card MasterCard
  • Credit Card Visa

After specifying one or more UserInput that you would validate, a new collection has to be created. It’s called ValidationForm. A ValidationForm is a custom type collection that contains all the UserInput within the validation process. It’s a virtual representation the current Page data.

At this point the validation takes places. Calling the method (Validate +1 Overload), every single UserInput object within the ValidationForm will be validated using the specified Validation Logic.

image
If the validation succeed IsValid (boolean) property of the ValidationForm will be set to true.

If the validation fails, the developer could easily loop through the collection and collect every single Input that has failed the validation (line 13 to 15).

About Alessio Marziali

Alessio Marziali (MCTS) is a Security Consultant with 9 years of experience developing secure applications with Microsoft .NET in a variety of sectors in UK and Italy. Published technical author with two ASP.NET books currently available for purchase and OWASP Code Crawler Project Leader.
Comments (0) Trackbacks (0)

No comments yet.


Leave a comment


CAPTCHA image

No trackbacks yet.