input-validation
Safeguard articles tagged "input-validation" — guides, analysis, and best practices for software supply chain and application security.
64 articles
Two Correct Parsers Can Disagree About the Same Multipart Request
A duplicate field name, an unusual boundary, a malformed header. Two standards-compliant parsers can resolve the same ambiguous bytes differently, and if a validator reads one interpretation while your application reads another, validation passed something it never actually checked.
Your Config Parser Is an Interpreter and the File Chooses What It Does
Configuration feels inert because it looks like data. Several formats can execute code and several loaders will by default, which makes parsing a security decision the moment the file comes from anywhere but your own repository.
Your Queue Consumer Is an Endpoint Nobody Reviewed
Your API validates every request and authenticates every caller. Behind it a worker reads messages and acts on them with none of those checks, because internal is trusted. That worker takes untrusted input and performs privileged actions.
Python email module address-parsing confusion (CVE-2023-27043)
CVE-2023-27043 shows how a Python email-parsing quirk lets attackers spoof trusted domains and bypass allowlist-based access controls silently.
Regular expression injection explained
Regex injection lets attackers rewrite pattern logic or trigger ReDoS. See real CVEs, exploit examples, and how to detect and fix it in your code.
Improper input validation (CWE-20) explained
CWE-20 explained: how improper input validation causes SQLi, RCE, and DoS, with real CVEs like Equifax's Struts breach and how to detect and fix it.
NoSQL injection prevention in MongoDB and Mongoose
A single unsanitized query key like $ne can bypass authentication in MongoDB apps — two 2024-2025 Mongoose CVEs show the fix is harder than one middleware package.
Secure Coding Fundamentals: A No-Jargon Checklist for New Developers
Three habits — validating input, managing secrets, and pinning dependencies — sit behind most preventable breaches, from Log4Shell to the event-stream hack.
XPath injection: how it happens and how to stop it in Java, .NET, and PHP
A 2024 GeoServer flaw showed unsanitized input reaching an XPath evaluator can mean remote code execution, not just data leakage. Here's how to prevent it.
Preventing SMTP injection vulnerabilities in email-sending code
A crafted From address turned PHPMailer into a remote code execution bug in 2016 — here's how header injection works and how to stop it.
Safely Parsing Untrusted URLs in Node.js
Node's legacy url.parse() is deprecated (DEP0169), and parser mismatches between it, the WHATWG URL API, and fetchers are a documented root cause of SSRF and open redirects.
Using Jakarta Bean Validation correctly: a defensive walkthrough
Jakarta Bean Validation stops malformed input, not attackers — a 2025 Hibernate Validator EL-injection flaw (CVSS 7.3) shows what goes wrong when teams conflate the two.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.