包括的な入力検証戦略
ホワイトリスト、正規化、厳格なデータ型の適用など、堅牢な入力検証処理を実装し、さまざまな入力ベースの攻撃を無効化する方法を学習します。
「包括的な入力検証戦略」はCoddyKit上の無料Secure Coding & OWASP Top 10 for Backendレッスンです。 これはレッスン2/4です。 下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。 これはSecure Coding & OWASP Top 10 for Backend学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Secure Coding & OWASP Top 10 for Backendコースには全4レッスンが含まれています。
このレッスンの一部はまだ翻訳されておらず、英語で表示されています。
Why Validate Input?
Input validation is the process of ensuring that data provided by a user or another system conforms to expected formats and constraints.
It's your first and most critical line of defense against many types of attacks, like injection, buffer overflows, and even simple logic errors.
Always assume external input is malicious until proven otherwise!
Whitelisting for Safety
When validating input, the safest approach is whitelisting. This means you define what is explicitly allowed, and reject everything else.
- Whitelisting: "Only these characters/patterns are allowed."
- Blacklisting: "These characters/patterns are forbidden."
Blacklisting is dangerous because attackers often find ways around forbidden patterns. Whitelisting is proactive and far more secure.
Simple Whitelist Check
Here's a simple Java example of whitelisting allowed characters for a username. Only letters, numbers, and underscore are permitted.
public class InputValidator {
public static boolean isValidUsername(String username) {
if (username == null || username.isEmpty()) {
return false;
}
// Whitelist: only letters, numbers, and underscore
return username.matches("^[a-zA-Z0-9_]+$");
}
public static void main(String[] args) {
String user1 = "coddy_kit_123";
String user2 = "bad user!";
String user3 = "admin";
System.out.println("User '" + user1 + "' is valid: " + isValidUsername(user1));
System.out.println("User '" + user2 + "' is valid: " + isValidUsername(user2));
System.out.println("User '" + user3 + "' is valid: " + isValidUsername(user3));
}
}Normalize Your Inputs
Canonicalization (or normalization) is the process of converting input data into a standard, simplified, or "canonical" form before validation.
This is crucial because attackers often try to bypass validation by encoding input in different ways (e.g., %2F for /, & for &). Canonicalization ensures all variations are reduced to a common representation.
Canonicalization in Action
This Java snippet shows how you might canonicalize a path by decoding URL encoding and simplifying path components (e.g., removing /./ or /../ if allowed, though typically ../ should be blocked).
import java.net.URLDecoder;
import java.nio.charset.StandardCharsets;
public class PathCanonicalizer {
public static String canonicalizePath(String path) {
try {
// 1. URL Decode the path
String decodedPath = URLDecoder.decode(path, StandardCharsets.UTF_8.name());
// 2. Normalize path separators (e.g., replace backslashes with forward slashes)
decodedPath = decodedPath.replace("\\", "/");
// 3. Remove redundant path elements (e.g., /./)
decodedPath = decodedPath.replace("/./", "/");
// Note: Full path traversal prevention requires more complex logic
// and often involves resolving the path against a base directory.
return decodedPath;
} catch (Exception e) {
return null; // Handle decoding errors
}
}
public static void main(String[] args) {
String input1 = "/usr/local/%2E%2E/etc/passwd";
String input2 = "/app/data/./report.txt";
System.out.println("Original: " + input1 + "\nCanonical: " + canonicalizePath(input1));
System.out.println("\nOriginal: " + input2 + "\nCanonical: " + canonicalizePath(input2));
}
}Enforce Data Types
Beyond character sets, validating the data type of input is essential. If you expect an integer, ensure it's an integer. If you expect a boolean, ensure it's true or false.
Incorrect data types can lead to:
- Application crashes
- Unexpected behavior
- Security vulnerabilities (e.g., type juggling attacks in some languages)
Type Check Example
This Java example demonstrates how to parse a string into an integer safely, catching potential NumberFormatExceptions.
public class DataTypeEnforcer {
public static Integer parseIntegerSafely(String input) {
if (input == null || input.trim().isEmpty()) {
return null; // Or throw an IllegalArgumentException
}
try {
return Integer.parseInt(input.trim());
} catch (NumberFormatException e) {
System.err.println("Error: '" + input + "' is not a valid integer.");
return null; // Indicate failure
}
}
public static void main(String[] args) {
String validNum = "12345";
String invalidNum = "abc";
String negativeNum = "-50";
System.out.println("Parsed '" + validNum + "': " + parseIntegerSafely(validNum));
System.out.println("Parsed '" + invalidNum + "': " + parseIntegerSafely(invalidNum));
System.out.println("Parsed '" + negativeNum + "': " + parseIntegerSafely(negativeNum));
}
}Limit & Format
Input validation also includes checking the length and format of data:
- Length Validation: Prevent excessively long inputs that could cause buffer overflows or denial-of-service attacks. Set minimum and maximum lengths.
- Format Validation: Use regular expressions (regex) to ensure input matches specific patterns, like email addresses, phone numbers, or UUIDs.
Combine these with whitelisting for robust checks.
Server-Side is Key
Remember, client-side validation (in the browser) is only for user experience. Attackers can easily bypass it.
All critical input validation must occur on the server-side. This ensures that even if a malicious user bypasses client-side checks, your backend remains secure.
Never trust input coming from the client!
Validate Your Knowledge
Which of the following are recommended best practices for comprehensive input validation?
Summary of Validation
In this lesson, we explored comprehensive input validation strategies:
- Always use whitelisting to define what's allowed.
- Perform canonicalization to normalize input and defeat encoding tricks.
- Enforce strict data types to prevent unexpected behavior.
- Validate length and format using regex.
- Crucially, always perform validation on the server-side.
Robust input validation is a cornerstone of secure backend development!
よくある質問
「包括的な入力検証戦略」レッスンは無料ですか？
はい。「包括的な入力検証戦略」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Secure Coding & OWASP Top 10 for Backendコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Secure Coding & OWASP Top 10 for Backendコースには全4レッスンが含まれています。
「包括的な入力検証戦略」で何を学びますか？
ホワイトリスト、正規化、厳格なデータ型の適用など、堅牢な入力検証処理を実装し、さまざまな入力ベースの攻撃を無効化する方法を学習します。 ブラウザで直接実行するハンズオンコードでSecure Coding & OWASP Top 10 for Backendを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。
Secure Coding & OWASP Top 10 for Backendを始めるのに経験は必要ですか？
事前経験は必要ありません。CoddyKitのSecure Coding & OWASP Top 10 for Backendは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。 これはレッスン2/4です。
「包括的な入力検証戦略」レッスンにはどのくらい時間がかかりますか？
ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。
このSecure Coding & OWASP Top 10 for Backendレッスンでコードを書いて実行できますか？
はい。すべてのSecure Coding & OWASP Top 10 for Backendレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。