Validate String Input for Injection

HardPython

Problem

WatchGuard security surfaces such as Firebox management APIs and WatchGuard Cloud services must reject input containing common injection signatures. Implement a validator that returns True when an input contains one of the specified suspicious patterns, and False otherwise.

Before matching, normalize the input by repeatedly URL-decoding it up to two times, converting HTML entities, lowercasing it, and replacing each whitespace run with one space. Do not remove punctuation, because punctuation is significant for several signatures.

Formal Specification

Implement is_suspicious(value), where value is a string. Return a boolean. Treat an empty string as safe. Detect these case-insensitive signatures after normalization:

SQL-like patterns: union select, drop table, or an expression such as ' or 1=1.
Command-like patterns: ;, &&, or || followed by cat, curl, wget, nc, or whoami.
Script-like patterns: an opening <script tag, javascript:, or an onerror= or onload= attribute.

The validator only needs to recognize the listed signatures. It is not expected to prove that arbitrary input is safe.

Constraints

0 <= len(value) <= 100,000
value is a string containing printable text
Input may contain URL or HTML encoding
URL decoding is limited to two passes
Matching is case-insensitive

Function Signature

def is_suspicious(value):

Formal Specification

Implement is_suspicious(value), where value is a string. Return a boolean. Treat an empty string as safe. Detect these case-insensitive signatures after normalization:

SQL-like patterns: union select, drop table, or an expression such as ' or 1=1.
Command-like patterns: ;, &&, or || followed by cat, curl, wget, nc, or whoami.
Script-like patterns: an opening <script tag, javascript:, or an onerror= or onload= attribute.

The validator only needs to recognize the listed signatures. It is not expected to prove that arbitrary input is safe.