Jon Chery
64 lines
2.6 KiB
Markdown
64 lines
2.6 KiB
Markdown
# Input Validation — Derived Rules
|
|
|
|
> Derives from `domains/security/first-principles.md` P4 (Input Validation), P5 (Output Safety).
|
|
|
|
## The Rule
|
|
|
|
All input is untrusted until validated. Validation happens at the boundary, against a schema, with explicit failure modes.
|
|
|
|
## Validate at the Boundary (P4 Locality)
|
|
|
|
- The API endpoint, the controller, the message handler — the entry point validates.
|
|
- Internal code trusts validated input. Unvalidated input never reaches the database.
|
|
- Defense in depth: the database also has constraints (P3 Defense in Depth).
|
|
|
|
## Schema Validation
|
|
|
|
- Use a schema library (zod, joi, pydantic, json-schema). Never hand-write validation.
|
|
- The schema is the contract. The schema is versioned. The schema is tested.
|
|
- Reject unknown fields (`additionalProperties: false` by default). Be explicit.
|
|
|
|
## Validation Types
|
|
|
|
### Type Validation
|
|
- `id` is a UUID, not a string. `age` is an integer ≥ 0. `email` matches a regex (or better, is parsed).
|
|
- Never accept `any`. Never accept `string` for a typed value.
|
|
|
|
### Range Validation
|
|
- `limit` ≤ 100. `page` ≥ 1. `quantity` ≥ 1 and ≤ stock.
|
|
- Bounds are explicit. No "unbounded" inputs.
|
|
|
|
### Format Validation
|
|
- `email` is parsed (not just regex). `url` is parsed. `date` is parsed.
|
|
- A regex for email is wrong (RFC 5322 is not a regular language). Use a parser.
|
|
|
|
### Semantic Validation
|
|
- `start_date < end_date`. `user_id` exists. `product_id` is in stock.
|
|
- Semantic validation may require a database lookup. That's fine.
|
|
|
|
### Presence Validation
|
|
- Required fields are present. Optional fields are absent or null.
|
|
- Empty string `""` is not the same as null. Be explicit about which you accept.
|
|
|
|
## Failure Modes (P8 Fail Securely)
|
|
|
|
- Validation failure → 400 Bad Request with a structured error (`domains/api/error-responses.md`).
|
|
- Never coerce: `"5" + 3` is not validation. Reject, don't guess.
|
|
- Never default: a missing required field is an error, not a default value.
|
|
|
|
## Output Safety (P5 Output Safety)
|
|
|
|
- Validation is for input. Encoding is for output.
|
|
- Output to HTML: HTML-encode. Output to SQL: parameterize. Output to URL: URL-encode.
|
|
- Never trust validated input for output. Validate on the way in, encode on the way out.
|
|
|
|
## What Violates Input Validation
|
|
|
|
| Violation | Principle |
|
|
|-----------|-----------|
|
|
| `JSON.parse(req.body)` with no schema | P4 Input Validation |
|
|
| `parseInt(req.query.id)` with no range check | P4 |
|
|
| `additionalProperties: true` by default | P1 Contract Fidelity |
|
|
| Coercing `"5"` to `5` silently | P8 Fail Securely |
|
|
| SQL string interpolation (even of "validated" input) | P5 Output Safety |
|
|
| Regex for email validation | P4 (use a parser) | |