(1) Does the below example employ input validation? (2) Why or why not. (3) From a secure coding perspective, why would we want to validate input? (4) Post the OWASP guidance URL on input validation
.
private static final Pattern zipPattern = Pattern.compile("^\d{5}(-\d{4})?$");
public void doPost( HttpServletRequest request, HttpServletResponse response) {
try { String zipCode = request.getParameter( "zip" );
if ( !zipPattern.matcher( zipCode ).matches() {
throw new YourValidationException( "Improper zipcode format." );
} // do what you want here, after its been validated ..
} catch(YourValidationException e ) {
response.sendError( response.SC_BAD_REQUEST, e.getMessage() );
} }
1. The given code doesn't employ input validation.
2. Reasons for the error:
3. From secure coding perspective,
4. OWASP URL for input validations:
The modified code for input validation is :
import java.util.regex.*;
//Used to handle regex operations.
import javax.servlet.http.*;
//used to handle servlet opeartions
import java.io.*;
//User defined exception declaration
class
YourValidationException extends Exception
{
public
YourValidationException(String s)
{
//
Call constructor of parent Exception
super(s);
}
}
public class Main
{
//Modified
regular expression.
private static
final Pattern zipPattern =
Pattern.compile("^\\d{5}(-\\d{4})?$");
//added static key
to call the method from main method. as static method cannot access
not static method.
public
static void doPost(HttpServletRequest request, HttpServletResponse
response) throws IOException {
try
{
String
zipCode = request.getParameter( "zip" );
if(
!zipPattern.matcher( zipCode ).matches()) {
throw
new YourValidationException( "Improper zipcode format." );
} // do what
you want here, after its been validated ..
} catch(YourValidationException
e ) {
response.sendError(
response.SC_BAD_REQUEST, e.getMessage() );
}
}
public Main() {
//
TODO Auto-generated constructor stub
System.out.println("Inside
constructor");
}
public static void
main(String[] args) throws IOException {
//creating a dummy variables for request and
response.
HttpServletRequest req ;
HttpServletResponse
res;
String
zip = "123456";
String
zipCode = req.getParameter(zip);
doPost(req,
res);
}
}
(1) Does the below example employ input validation? (2) Why or why not. (3) From a...
Homework 3: Input Validation 1 Objectives control structures console-based user input using Scanner class writing complete programs using two classes: client and supplier 2 User Interface Specification This is a console-based I/O program. Display should go to System.out (print or println) and the program will get user input using the Scanner class. The flow of execution should be as follows: When the program starts, display a one-line introduction to the user Display a menu with 5 options 1. validate zip...
I am required to use the try - catch block to validate the input as the test data uses a word "Thirty" and not numbers. The program needs to validate that input, throw an exception and then display the error message. If I don't use the try - catch method I end up with program crashing. My issue is that I can't get the try - catch portion to work. Can you please help? I have attached what I have...