Regex Group Verification via Flow ID Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional regex sanitization and validation methods are flawed, as they may incorrectly assume tainted input as sanitized, failing to detect vulnerabilities such as Cross-site scripting, SQL injection, and command injection attacks.
Innovation Solution
A system and method that verify a regex group in an application testing process by creating a flow ID to track the regex group's flow, checking if it's previously tested, and passing tasks through a regex sanitizer and validator to test for vulnerabilities, qualifying the regex group as valid or invalid based on the output.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional regex sanitization and validation methods are used, then the processing speed is fast and implementation is simple, but the reliability is poor and vulnerabilities such as SQL injection and cross-site scripting attacks cannot be detected
Solution Approach 1:
The patent segments the input data processing into multiple distinct phases: initial regex validation, sanitization processing, and secondary verification. Each phase handles specific aspects of security checking, allowing the system to maintain high reliability through comprehensive coverage while managing complexity by organizing checks into modular, sequential steps rather than a monolithic process
Solution Approach 2:
The patent applies preliminary regex validation and sanitization before the main processing, and then performs additional verification afterward. This preliminary and follow-up action ensures that obvious vulnerabilities are caught early while more subtle threats are detected in subsequent checks, improving overall detection accuracy without requiring all checks to run simultaneously
2Reliability
If comprehensive vulnerability testing is performed on all input data, then the detection accuracy improves, but the processing time increases
Solution Approach 1:
The patent applies partial verification by performing regex-based checks on specific patterns and portions of input data rather than exhaustive analysis of every character and combination. This selective approach catches the most common and critical vulnerabilities (SQL injection, cross-site scripting) while avoiding the exponential time cost of complete brute-force testing
Solution Approach 2:
The patent skips detailed analysis of already-sanitized portions of input data by using regex patterns to quickly identify and flag only the suspicious elements that require further scrutiny. This allows the system to rush through the majority of benign data while focusing computational resources on potential threats
Data Source
AI summary
Disclosed is a method and system for verifying a regex group. The method comprises verifying of a regex group by creating a flow id through a processor for the regex group when source reaches the sink. The flow id is used for tracking the flow of the regex group. The processor checks in case the flow id is a previously tested flow id. When the flow id is not the previously tested flow id, the processor passes one or more run tasks through a processor forming a queue. The processor tests for one or more vulnerabilities to be associated with the regex group based on the passing, wherein the testing is used to qualify the regex group as a valid regex group.