Validate StudyBuddy form fields on the server with allow-lists, and flag suspicious input for the security log.
Input: lines field value... until the end of input (the value is the rest of the line, possibly with spaces). Rules:
| Field | Valid if |
|---|---|
courseCode |
3 or 4 capital letters, one space, 4 digits (e.g. CPS 4301) |
studentId |
exactly 7 digits |
email |
letters, digits, ., _ or - (at least 1), then @wku.edu.cn or @kean.edu |
displayName |
2 to 30 characters, only letters, spaces, ' and -, and not only spaces |
groupSize |
an integer from 2 to 6 (no sign, no leading zeros) |
Output per line: field: ACCEPT or field: REJECT, and, for rejected values only, add [SUSPICIOUS] if the value contains any of: ', --, ;, <, > — except that a ' alone in a displayName is legal (e.g., O'Brien), so for displayName only --, ;, <, > count. An unknown field gives field: UNKNOWN FIELD.
At the end: Accepted: a, Rejected: r, Suspicious: s.
Input:
courseCode CPS 4301
courseCode cps4301
studentId 1234567
email yuki.tanaka@wku.edu.cn
email yuki@gmail.com
displayName Sean O'Brien
displayName <script>alert(1)</script>
groupSize 7
Output:
courseCode: ACCEPT
courseCode: REJECT
studentId: ACCEPT
email: ACCEPT
email: REJECT
displayName: ACCEPT
displayName: REJECT [SUSPICIOUS]
groupSize: REJECT
Accepted: 4, Rejected: 4, Suspicious: 1