input-validation

Implement comprehensive input validation to prevent XSS, SQL injection, and command injection attacks with sanitization strategies

Hack23 236 56 Updated 6mo ago

GitHub

Install

npx skillscat add hack23/cia/input-validation

Install via the SkillsCat registry.

SKILL.md

Input Validation Skill

Purpose

This skill provides systematic approaches to validate, sanitize, and encode all user inputs to prevent injection attacks, XSS, and data corruption. It implements defense-in-depth validation at multiple layers aligned with OWASP best practices and Hack23 ISMS secure coding standards.

When to Use This Skill

Apply this skill when:

✅ Processing any user-provided input (forms, APIs, URL parameters)
✅ Handling data from external systems (Riksdagen API, World Bank)
✅ Constructing database queries or commands
✅ Rendering user-generated content in UI
✅ Processing file uploads
✅ Implementing search functionality
✅ Building dynamic SQL, LDAP, or OS commands

Validation Principles

Principle #1: Validate Early, Validate Often

Multi-Layer Validation:

Client Side (JavaScript)  → Basic UX validation
    ↓
Server Side (Controller)  → Format and type validation
    ↓
Service Layer            → Business logic validation
    ↓
Database Layer           → Constraint enforcement

Principle #2: Allowlist Over Blocklist

❌ INSECURE - Blocklist Approach:

// BAD: Trying to block malicious patterns (incomplete, bypassable)
public boolean isValidInput(String input) {
    String[] badPatterns = {"<script>", "javascript:", "onerror=", "' OR '1'='1"};
    for (String pattern : badPatterns) {
        if (input.toLowerCase().contains(pattern)) {
            return false;
        }
    }
    return true;
}

✅ SECURE - Allowlist Approach:

// GOOD: Define what IS valid
public boolean isValidPoliticianName(String name) {
    // Only allow letters, spaces, hyphens, and apostrophes
    return name != null && 
           name.matches("^[A-Za-zÀ-ÿ\\s'-]{2,50}$") &&
           name.length() >= 2 &&
           name.length() <= 50;
}

public boolean isValidEmail(String email) {
    // Use standard email regex
    String emailRegex = "^[A-Za-z0-9+_.-]+@[A-Za-z0-9.-]+\\.[A-Za-z]{2,}$";
    return email != null && email.matches(emailRegex);
}

public boolean isValidYear(Integer year) {
    // Define valid range
    int currentYear = Year.now().getValue();
    return year != null && 
           year >= 1900 && 
           year <= currentYear;
}

Principle #3: Fail Securely

@ControllerAdvice
public class ValidationExceptionHandler {
    
    private static final Logger log = LoggerFactory.getLogger(ValidationExceptionHandler.class);
    
    @ExceptionHandler(MethodArgumentNotValidException.class)
    public ResponseEntity<ErrorResponse> handleValidationException(
            MethodArgumentNotValidException ex) {
        
        // Log detailed error for debugging (but don't expose to user)
        log.warn("Validation failed: {}", ex.getBindingResult().getAllErrors());
        
        // Return generic error to user (don't leak validation logic)
        ErrorResponse error = new ErrorResponse(
            "Invalid input",
            "One or more fields contain invalid data"
        );
        
        return ResponseEntity.badRequest().body(error);
    }
    
    @ExceptionHandler(ConstraintViolationException.class)
    public ResponseEntity<ErrorResponse> handleConstraintViolation(
            ConstraintViolationException ex) {
        
        log.warn("Constraint violation: {}", ex.getMessage());
        
        ErrorResponse error = new ErrorResponse(
            "Invalid input",
            "The provided data does not meet requirements"
        );
        
        return ResponseEntity.badRequest().body(error);
    }
}