input-validation
Installation
SKILL.md
Input Validation
Validate and sanitize ALL user input at every entry point. This covers Finding #2 (path traversal) and extends beyond SQL injection to XSS, command injection, and data integrity.
The Rule
NEVER trust user input. ALWAYS validate type, length, format, and range on the server side.
Attack Vectors Prevented
| Attack | How it works | Validation fix |
|---|---|---|
| XSS | Inject <script> into rendered HTML |
HTML-encode output, validate no HTML in text fields |
| Path Traversal | ../../etc/passwd in file paths |
Whitelist allowed paths, reject .. |
| Command Injection | ; rm -rf / in shell commands |
Never pass user input to shell, use spawn with args array |
| SSRF | User-controlled URLs fetch internal services | Whitelist allowed domains, block private IPs |
| Prototype Pollution | __proto__ in JSON keys |
Strip dangerous keys, use Object.create(null) |
| File Upload Abuse | .php file uploaded as "image" |
Validate MIME type + magic bytes, not just extension |