Module de.cuioss.http
Package de.cuioss.http.security.pipeline

Class URLParameterValidationPipeline

java.lang.Object
de.cuioss.http.security.pipeline.AbstractValidationPipeline
de.cuioss.http.security.pipeline.URLParameterValidationPipeline
All Implemented Interfaces:
HttpSecurityValidator
public final class URLParameterValidationPipeline extends AbstractValidationPipeline
Sequential validation pipeline specifically for URL parameter components.

Validation Sequence

  1. Length Validation - Enforces maximum parameter length limits
  2. Character Validation - Validates RFC 3986 query characters
  3. Decoding - URL decodes with security checks
  4. Normalization - Parameter normalization and security checks
  5. Pattern Matching - Detects injection attacks and suspicious patterns

Design Principles

  • Sequential Execution - Each stage processes the output of the previous stage
  • Early Termination - Pipeline stops on first security violation
  • Security First - Validates before any transformation
  • Immutable - Thread-safe pipeline instance

Usage Example

 SecurityConfiguration config = SecurityConfiguration.defaults();
 SecurityEventCounter counter = new SecurityEventCounter();

 URLParameterValidationPipeline pipeline = new URLParameterValidationPipeline(config, counter);

 try {
     String safeParam = pipeline.validate("user_id=123");
     // Use safeParam for processing
 } catch (UrlSecurityException e) {
     // Handle security violation
     log.warn("Parameter validation failed: {}", e.getMessage());
 }
Implements: Task P2 from HTTP verification specification
Since:
1.0