Web Service Input Validation

I've been blogging on importance of input validatoin some time ago App Architecture with Security in mind - Video, Part I

Web Services is not different from ASPX - accept parameters and process it. So the strategy for input validation should be the same as with ASPX - each and every input parameter MUST be checked for goodness (no black list allowed!). The only difference with ASPX is that there is no validation controls for ASMX, so the simplest way would be as follows:

from http://msdn2.microsoft.com/en-us/library/ms998375.aspx#pagquestionlist0001_input1

[WebMethod]

public decimal RetrieveAccountBalance(string accountId)

{ 

   if (!Regex.IsMatch(accountId,@"^[a-zA-Z'.\s]{1,40}$")) 

   { 

      // AccountID does not match expression 

      // do not process request 

   }

}

Common regex patterns are here: http://msdn2.microsoft.com/en-us/library/ms998267.aspx

It is more complicated when dealing with complex types as input parameters - will save it for the next post

Enjoy