.NET Web Service Validation - Revision history

MediaWiki spam cleanup: Reverting to last version not containing links to www.textcococri.com

2009-05-27T18:28:20Z

Reverting to last version not containing links to www.textcococri.com

Deleted user at 20:25, 21 May 2009

2009-05-21T20:25:43Z

Meddington: /* Downloading */

2008-02-17T00:12:11Z

‎Downloading

Meddington at 09:30, 3 November 2007

2007-11-03T09:30:08Z

Esheridan at 18:50, 2 February 2007

2007-02-02T18:50:09Z

Meddington at 04:38, 12 December 2006

2006-12-12T04:38:08Z

Meddington at 04:16, 12 December 2006

2006-12-12T04:16:48Z

Meddington at 04:04, 20 November 2006

2006-11-20T04:04:58Z

Meddington at 03:57, 20 November 2006

2006-11-20T03:57:37Z

Meddington at 03:18, 20 November 2006

2006-11-20T03:18:31Z

← Older revision		Revision as of 18:28, 27 May 2009
Line 1:		Line 1:
−	~~http://www.textcococri.com~~
	There was a great article on MSDN a while back (years at this point) that showed the creation of a SOAP extension that would verify incoming requests against a schema, something .NET does not support out of the box (even in 2.0). Additionally there was quasi support for [http://www.schematron.com/ schematron] via Assert attributes. This allows for a very powerful input validation of web services.		There was a great article on MSDN a while back (years at this point) that showed the creation of a SOAP extension that would verify incoming requests against a schema, something .NET does not support out of the box (even in 2.0). Additionally there was quasi support for [http://www.schematron.com/ schematron] via Assert attributes. This allows for a very powerful input validation of web services.

← Older revision		Revision as of 20:25, 21 May 2009
Line 1:		Line 1:
		+	http://www.textcococri.com
	There was a great article on MSDN a while back (years at this point) that showed the creation of a SOAP extension that would verify incoming requests against a schema, something .NET does not support out of the box (even in 2.0). Additionally there was quasi support for [http://www.schematron.com/ schematron] via Assert attributes. This allows for a very powerful input validation of web services.		There was a great article on MSDN a while back (years at this point) that showed the creation of a SOAP extension that would verify incoming requests against a schema, something .NET does not support out of the box (even in 2.0). Additionally there was quasi support for [http://www.schematron.com/ schematron] via Assert attributes. This allows for a very powerful input validation of web services.

← Older revision		Revision as of 00:12, 17 February 2008
Line 14:		Line 14:

	[http://canoodle.googlecode.com/files/SoapValidation-0.5-src.zip SoapValidation-0.5-src.zip] - Source, documentation, samples		[http://canoodle.googlecode.com/files/SoapValidation-0.5-src.zip SoapValidation-0.5-src.zip] - Source, documentation, samples
		+
		+	The latest code is now being maintained in a [http://code.google.com/p/canoodle/ Google Code repository].

	== Installation ==		== Installation ==

@@ Line 11: / Line 11: @@
 == Downloading ==
-[http://phed.org/files/SoapValidation-0.5.msi SoapValidation-0.5.msi] - Assembly, documentation, samples
+[http://canoodle.googlecode.com/files/SoapValidation-0.5.msi SoapValidation-0.5.msi] - Assembly, documentation, samples
-[http://phed.org/files/SoapValidation-0.5-src.zip SoapValidation-0.5-src.zip] - Source, documentation, samples
+[http://canoodle.googlecode.com/files/SoapValidation-0.5-src.zip SoapValidation-0.5-src.zip] - Source, documentation, samples
 == Installation ==

← Older revision		Revision as of 18:50, 2 February 2007
Line 124:		Line 124:
	[[Category:OWASP Download]]		[[Category:OWASP Download]]
	[[Category:OWASP Tool]]		[[Category:OWASP Tool]]
		+	[[Category:OWASP Validation Project]]

@@ Line 112: / Line 112: @@
 </pre>
 <p>&nbsp;</p>
 [[Category:OWASP .NET Project]]
 [[Category:OWASP Download]]
 [[Category:OWASP Tool]]

← Older revision		Revision as of 04:16, 12 December 2006
Line 114:		Line 114:

	[[Category:OWASP .NET Project]]		[[Category:OWASP .NET Project]]
		+	[[Category:OWASP Download]]
		+	[[Category:OWASP Tool]]

← Older revision		Revision as of 04:04, 20 November 2006
Line 31:		Line 31:
	There are two methods for using the validator. First you can force all web methods to be validated using the web.config file. Second you can mark methods using [Validation] attribute.		There are two methods for using the validator. First you can force all web methods to be validated using the web.config file. Second you can mark methods using [Validation] attribute.

		+	<h3>Attributes</h3>
		+	<p>[<strong>Validation</strong>]</p>
		+	<p>Mark web method for validation against schemas</p>
		+	<p>[<strong>ValidationSchemaFolder</strong>(string relativeFolder)]</p>

		+	<p>Used to add folders that contain schemas to load and cache.  This attribute is only valid for classes.  The relativeFolder parameter is relative to the vroot.</p>
		+	<ul>
		+	<li><em>relativeFolder</em> -- Folder of schemas to load and cache.  Relative to the virtual root (vroot).</li></ul>
		+	<p>[<strong>ValidationSchema</strong>(string schemaFile)]</p>
		+
		+	<p>Used to add schema files to load and cache.  This attribute is only valid for classes.  The schemaFile parameter is relative to the vroot.</p>
		+	<ul>
		+	<li><em>schemaFile</em> -- Schema file to load.  Relative to the virtual root (vroot).</li></ul>
		+	<p>[<strong>Assert</strong>(string rule)]<br>[<strong>Assert</strong>(string rule, string description)]</p>
		+
		+	<p>Used to add an XPath validation expression to a web method.  The XPath expression must evaluate to true.</p>
		+	<ul>
		+	<li><em>rule</em> -- XPath validation expression.  Must evaluate to true.
		+	<li><em>description</em> -- [optional] Description of assertion rule.</li></ul>
		+	<p>[<strong>AssertNamespaceBinding</strong>(string prefix, string ns)]</p>
		+
		+	<p>Specifies namespace bindings used by assert xpath's.</p>
		+	<ul>
		+	<li><em>prefix</em> -- namespace prefix
		+	<li><em>ns</em> -- namespace to map to</li></ul>
		+	<hr>
		+
		+	<h3>Web.config Changes</h3>
		+	<p>First two extensions must be registered by adding the following inside of the <webServices> node:</p>
		+
		+	<p></p>
		+	<p></p><pre><soapExtensionReflectorTypes>
		+	<add type="SoapValidation.ValidationExtensionReflector, SoapValidation"/>
		+	</soapExtensionReflectorTypes>
		+	<serviceDescriptionFormatExtensionTypes>
		+	<add type="SoapValidation.ValidationFormatExtension, SoapValidation"/>
		+	</serviceDescriptionFormatExtensionTypes>
		+	</pre>
		+	<p>Next, POST and GET protocols must be disabled by adding the following inside of the <webServices> node:</p><pre><protocols>
		+
		+	<remove name="HttpPost" />
		+	<remove name="HttpGet" />
		+	</protocols>
		+	</pre>
		+	<p>Finally, if you want to force all web methods to be validated with out using the [Validation] attribute add the following inside of the <webServices> node:</p><pre><soapExtensionTypes>
		+	<add type="SoapValidation.ValidationExtension, SoapValidation" priority="1" group="0" />
		+
		+	</soapExtensionTypes>
		+	</pre>
		+	<hr>
		+
		+	<h3>Using Validation</h3>
		+	<p>Here is a basic example that will cause validation to be run:</p><pre>[WebService(Namespace="<a href="http://example.org/geometry")]public">http://example.org/geometry")]
		+	public</a> class SimpleTests : System.Web.Services.WebService
		+	{
		+	[WebMethod]
		+	[Validation]
		+	public double CalcArea2(double length, double width)
		+	{
		+	return length * width;
		+	}
		+	}</pre>
		+	<hr>
		+
		+	<h3>Using Assertions</h3>
		+
		+	<p>Here is an example of using assertions to verify business rules in a way schema's fall short.</p><pre>[AssertNamespaceBinding("t", "<a href="http://example.org/geometry")]">http://example.org/geometry")]</a>
		+	[WebService(Namespace="<a href="http://example.org/geometry")]">http://example.org/geometry")]</a>
		+	public class SimpleTests : System.Web.Services.WebService
		+	{
		+	[WebMethod]
		+	[Validation]
		+	[Assert("(//t:length * //t:width) > 100", "Area must be greater than 100")]
		+	[Assert("(//t:length div //t:width) = 2", "Length must be exactly twice width")]
		+	public double CalcArea2(double length, double width)
		+	{
		+	return length * width;
		+	}
		+	}
		+	</pre>
		+	<p> </p>

	[[Category:OWASP .NET Project]]		[[Category:OWASP .NET Project]]

@@ Line 19: / Line 19: @@
 Download the installer and run.  Easy :)
-== Methods of Use ==
+== Reporting Bugs ==
-There are two methods for using the validator.  First you can force all web methods to be validated using the web.config file.  Second you can mark methods using [Validation] attribute.
+Report bugs to Michael Eddington @ meddington@phed.org.
 == Use ==
@@ Line 27: / Line 27: @@
 Add a reference to SoapValidator.dll from your web service project.  Modify your web.config to include the required settings and add attributes to classes and/or methods.  See examples later.
-== Reporting Bugs ==
+=== Methods of Use ===
 [[Category:OWASP .NET Project]]

← Older revision		Revision as of 03:18, 20 November 2006
Line 30:		Line 30:

	Report bugs to Michael Eddington @ meddington@phed.org.		Report bugs to Michael Eddington @ meddington@phed.org.
		+
		+	[[Category:OWASP .NET Project]]