Rich Web application input validation

1. A method for validating a request to a Web application, the request having a data, the method comprising:

creating a validation engine in a programmable processor, the validation engine comprising a validation logic, said validation logic comprising a rich validation rule, said rich validation rule using a plurality of ordered validation rule primitives (VRPs), said plurality of VRPs being selected from a group consisting of an acceptance VRP, a rejection VRP, and a combination thereof;

loading said rich validation rule;

applying said rich validation rule to the data, whereby the data is accepted if at least one of said acceptance VRPs succeeds and all of said rejection VRPs fail; and

sending the request to the Web application.

2. A method for validating a request to a Web application, the request having a data comprising:

creating a validation engine in a programmable processor, the validation engine comprising a validation logic, said validation logic comprising a validation rule, said validation rule corresponding to a defined plurality of data elements;

loading said validation rule;

applying said validation rule to said data elements; and

sending said request to the Web application.

3. The method according to claim 1 , wherein said validation engine resides in an application firewall.

4. The method according to claim 1 , wherein said VRP is validation engine built-in validation logic, validation engine custom validation function, or Perl regular expression.

5. The method according to claim 4 , wherein said built-in validation logic uses a well-known named VRP, wherein said built-in validation logic is further customized by modifying said named VRP.

6. The method according to claim 4 , wherein said custom validation logic is added to said validation engine as an external code module.

7. The method according to claim 1 , wherein said validation engine serves the Web application, and provides validation logic customized to the Web application.

8. The method according to claim 1 , wherein said VRP is a list of characters.

9. The method according to claim 1 , wherein said VRP is defined and referenced by name.

10. The method according to claim 1 , wherein said VRP is flagged to override the logic of the VRPs that follows said VRP.

11. The method according to claim 1 , wherein said VRP is used to modify the data used by VRPs that follows said VRP.

12. The method according to claim 1 , wherein the Web application is an engine creating Web pages from application logic, stored data, and user input.

13. The method according to claim 2 , wherein said plurality of data elements comprises parameter names of the request, said parameter names being associated with their value.

14. The method according to claim 2 , wherein said plurality of data elements are Perl regular expression.

15. The method according to claim 13 , wherein said validation rule is a global rejection rule applying to all parameter names and values.

16. The method according to claim 15 , further comprising the step of overriding the global rejection rule by a second rule.

17. The method as claimed in claim 15 , wherein the said global rejection rule comprises a list of well-known values and characters used in security exploits.

18. The method as claimed in claim 2 , wherein an XPath expression is used to identify said plurality of data elements in an XML request.

19. The method according to claim 2 , wherein said plurality of data elements are dynamically defined by communication between the Web application and an application firewall.

20. The method according to claim 2 , wherein the Web application is an engine creating Web pages from application logic, stored data, and user input.

21. A storage device readable by a computer encoding a computer program for execution by the computer to carry out a method for validating a request to a Web application, the computer program comprising:

code means for creating a validation engine comprising a validation logic, said validation logic comprising a rich validation rule, said rich validation rule using a plurality of ordered validation rule primitives (VRPs), said plurality of VRPs being selected from a group consisting of an acceptance VRP, a rejection VRP, and a combination thereof;

code means for loading said rich validation rule;

code means for applying said rich validation rule to the data, whereby the data is accepted if at least one of said acceptance VRPs succeeds and all of said rejection VRPs fail; and

code means for sending the request to the Web application.

22. A storage device readable by a computer encoding a computer program for execution by the computer to carry out a method for validating a request to a Web application, the computer program comprising:

code means for creating a validation engine comprising a validation logic, said validation logic comprising a validation rule, said validation rule corresponding to a defined plurality of data elements;

code means for loading said validation rule;

code means for applying said validation rule to the data; and

code means for sending said request to the Web application.

23. The storage device according to claim 21 , wherein said validation engine resides in an application firewall.

24. The storage device according to claim 21 , wherein said VRP is validation engine built-in validation logic, validation engine custom validation function, or Perl regular expression.

25. The storage device according to claim 24 , wherein said built-in validation logic uses a well-known named VRP, wherein said built-in validation logic is further customized by modifying said named VRP.

26. The storage device according to claim 24 , wherein said custom validation logic is added to said validation engine as an external code module.

27. The storage device according to claim 22 , wherein said plurality of data elements comprises parameter names of the request.

28. The storage device according to claim 22 , wherein said plurality of data elements are Perl regular expression.

29. The storage device according to claim 27 , wherein said validation rule is a global rejection rule applying to all parameter values.

30. The storage device according to claim 29 , further comprising the step of overriding the global rejection rule by a second rule.

31. The storage device according to claim 29 , wherein the said global rejection rule comprises a list of well-known values and characters used in security exploits.