Search code examples
regexeclipsejspsql-injection

RegEx Expression for Eclipse that searches for all items that have not been dealt with

To help stop SQL Injection attacks, I am going through about 2000 parameter requests in my code to validate them. I validate them by determining what type of value (e.g. integer, double) they should return and then applying a function to them to sanitize the value.

Any requests I have dealt with look like this 

*SecurityIssues.*(request.getParameter

where * signifies any number of characters on the same line.

What RegExp expression can I use in the Eclipse search (CTRL+H) which will help me search for all the ones I have not yet dealt with, i.e. all the times that the text request.getParameter appears when it is not preceded by the word SecurityIssues?

Examples for matches

The regular expression should match each of the following e.g.

int companyNo = StringFunctions.StringToInt(request.getParameter("COMPANY_NO‌​"))
double percentage = StringFunctions.StringToDouble(request.getParameter("MARKETSHARE"))
int c = request.getParameter("DUMMY")

But should not match:

int companyNo = SecurityIssues.StringToIntCompany(request.getParameter("COMP‌​ANY_NO"))
Solution

  • With inspiration and the links provided by @michaeak (thank you), as well as testing in https://regex101.com/ I appear to have found the answer:

    ^((?!SecurityIssues).)*(request\.getParameter)

    The advantage of this answer is that I can blacklist the word SecurityIssues, as opposed to having to whitelist the formats that I do want.

    Note, that it is relatively slow, and also slowed down my computer a lot when performing the search.