  Input validation is the first line of defense against malformed or malicious
inputs. It is therefore critical that the validator (which is often part of the
parser) is free of bugs.
  To build dependable input validators, we propose using parser generators for
context-free languages. In the context of network protocols, various works have
pointed at context-free languages as falling short to specify precisely or
concisely common idioms found in protocols. We review those assessments and
perform a rigorous, language-theoretic analysis of several common protocol
idioms. We then demonstrate the practical value of our findings by developing a
modular, robust, and efficient input validator for HTTP relying on context-free
grammars and regular expressions.
