Input Validation Bug in ASP.NET

So I found an interesting condition today in ASP.NET while doing some code in VS.NET 2003. If you use a RegularExpressionValidator on a web form it will NOT be called if the field is left blank. In other words, even though you apply regular expression input validation on a control, it won't actually be executed if the field is blank.

To me, this is a bug. If I add a regex of "^\d{1,2}$" (which means the field must have a MINIMUM of 1 digit and a MAXIMUM of 2 digits), it should be honored. In ASP.NET, that is apparently not the case. The fix is to add a second validator BEFORE it, using the RequiredFieldValidator. The fix looks something like:

<asp:RequiredFieldValidator id="ControlBlankValidator" runat="server" 

   ErrorMessage="Must enter a number between 0 and 99." InitialValue="" Display="Dynamic" 

   ControlToValidate="SomeControl">Must enter a number.</asp:RequiredFieldValidator>

<asp:RegularExpressionValidator id="ControlInputValidator" runat="server" 

   ErrorMessage="Invalid number. Must be between 0 and 99." 

   InitialValue="" Display="Dynamic" ControlToValidate="SomeControl" 

   ValidationExpression="^\d{1,2}$">Invalid number</asp:RegularExpressionValidator>

So if you are trying to be a good net-izen and are trying to validate your input with regular expressions, you need to test this edge case. There is a good chance you may not actually be catching this.

I contacted a dev security evangelist at Microsoft about this, and he confirms that this condition exists. He also tested it against VS.NET 2005, and apparently the same behaviour exists there as well. But Microsoft doesn't consider this a bug. Apparently the RegularExpressionValidator is not supposed to be tested against a null like its sister System.Text.RegularExpression. And that kind of makes sense since in a postback if there is no data it simply won't exist in the query string. After further discussion, it was brought up that if it didn't work this way, optional fields couldn't otherwise use a RegularExpressionValidator if it worked as I would expect it.

I think this needs to be documented better. If someone new to validating controls ASSUMES regex is honored in testing against a blank string, they will be sadly mistaken. You MUST validate against a NULL first with a RequiredFieldValidator.

Interesting find. Hope that's useful to someone out there.