Question

A security engineer is assisting a developer with input validation, and they are studying the following code block:

string accountIdRegexp = TODO, help!;private static final Pattern accountIdPattern = Pattern.compile
(accountIdRegexp);
String accountId = request.getParameter(accountNumber);
if (!accountIdPattern.matcher(accountId).matches() { System.out.println(account ID format incorrect);} else { //continue}

The security engineer wants to ensure strong input validation is in place for customer-provided account identifiers. These identifiers are ten-digit numbers. The developer wants to ensure input validation is fast because a large number of people use the system.

Which of the following would be the BEST advice for the security engineer to give to the developer?

A. Replace code with Java-based type checks
B. Parse input into an array
C. Use regular expressions
D. Canonicalize input into string objects before validation

Answer 1

The security engineer should advise the developer to use regular expressions for validating ten-digit account identifiers, as it offers a secure and efficient solution for processing a large number of requests. The appropriate regex pattern would be "^\d{10}$". (option C)

Step-by-step explanation:

The BEST advice for the security engineer to give to the developer would be to use regular expressions (regex) for input validation. Since the account identifiers are ten-digit numbers, the regular expression should match a string of exactly ten digits. Therefore, the regular expression to use in the accountIdRegexp string would be "^\d{10}$". This regex ensures that only a string that starts and ends with exactly ten digits is considered a match, which is both secure and efficient for processing a large number of requests. Here's how the Java code should be updated:

string accountIdRegexp = "^\\d{10}$";
private static final Pattern accountIdPattern = Pattern.compile(accountIdRegexp);
String accountId = request.getParameter(accountNumber);
if (!accountIdPattern.matcher(accountId).matches()) {
System.out.println("Account ID format incorrect");
} else {
// continue
}

Using a compiled Pattern is a good practice for performance since the JVM compiles the regex only once, and then it can be used for matching against multiple inputs. In contrast, type checks, parsing into an array, and string canonicalization would not provide the same mix of security benefits and performance efficiency as regex does.