A regular expression (regex) describes which characters may appear in text and how they may be ordered. In web applications, validation patterns can reject unexpected input before metacharacters reach downstream systems such as databases or operating-system commands. section 4.4
Restricting an HTTP parameter
A Ruby substitution replaces every character outside letters and digits with an underscore: input_value = input_value.gsub(/[^0-9a-z]/i, '_'). This removes characters that could carry special meaning downstream, although validation should fit the intended input rather than blindly rewriting it. section 4.4
Useful validation targets include:
- Email addresses with an expected format. section 4.4
- Dates with a well-formed arrangement of characters. section 4.4
- IP addresses with a believable format. section 4.4
Regexes also create a denial-of-service risk when users control the pattern. Deliberately ambiguous patterns can trigger extensive backtracking; repeated requests may consume server processing power in a regular expression denial-of-service (ReDoS) attack. Keep patterns static in server-side code, scan for unsafe insertion with static analysis, and use a dedicated search index for rich user-defined search syntax. section 12.15 section 12.16
input_value = input_value.gsub(/[^0-9a-z]/i, '_')
View the Ruby sanitization pattern that replaces nonalphanumeric input characters. section 4.4
from flask import request, jsonify
from elasticsearch import Elasticsearch
es_client = Elasticsearch([ ELASTIC_SEARCH_URL ])
@app.route("/document", methods=["POST"])
def add_document():
data = request.get_json()
result = es_client.index(index="documents", body=data)
return jsonify({"message": "Document indexed"}), 201
@app.route("/search/<search_query>", methods=["GET"])
def search(search_query):
result = es_client.search(
index="documents",
body={"query":
{"match": {"content": search_query}}})
return jsonify({"results": result["hits"]["hits"]}), 200
View a Flask and Elasticsearch alternative for rich search without evaluating user input as a regex. section 12.15
