input-validation
Safeguard articles tagged "input-validation" — guides, analysis, and best practices for software supply chain and application security.
62 articles
Validating URLs Safely in Python with the validators Library
The Python validators library's url validator is a quick way to check URLs, but older regex-based versions carried a ReDoS risk. Here's how to use it safely.
Joi npm: A Security Review and Safe Usage Guide
The joi npm package is the widely used JavaScript schema validation library. Here is its maintenance status, the @hapi/joi migration, and how to use it safely.
qrcode.react Security: Safe QR Code Rendering in React
A security guide to the qrcode.react library, the risks of encoding untrusted data into QR codes, and how to render them safely in a React app.
URLEncoder in Java: Correct Usage and Its Security Pitfalls
URLEncoder in Java is easy to misuse. Here is when it applies, why it is not URL encoding for whole URLs, and the injection risks of getting it wrong.
JavaScript Not Equal (!= vs !==): Why the Wrong One Is a Security Bug
The JavaScript not equal operators != and !== look interchangeable but aren't. Loose comparison triggers type coercion that has caused real auth bypasses. Here's how to compare safely.
How to Build a Secure Python URL Validator (and Avoid SSRF)
A Python URL validator has to do more than match a regex. Here is how to validate URLs safely, block SSRF, and pick between urllib, validators, and Pydantic.
Python: Check If a String Is a Valid URL (Safely)
How to check if a string is a URL in Python using urllib.parse, when to add validators, and why parseable does not mean safe for the URL you are about to fetch.
yup npm: A Security Review of the Schema Validation Library
The yup npm package is a mature, actively maintained schema validation library, and it is safe to use, but validation belongs on the server and yup schemas need to be written defensively. Here is the review.
SQL Injection for Beginners: How It Works and How to Stop It
SQL injection for beginners, explained without the hype: what the attack actually is, why string-built queries cause it, and the one habit — parameterized queries — that closes the door.
What Is Literal SQL Statement Injection, and How Do You Stop It?
Literal SQL statement injection happens when user input is concatenated straight into a query string. Here is how the attack works and how to shut it down.
pako on npm: Security Review and Safe Usage of the zlib Port
pako is a fast JavaScript port of zlib used for gzip and deflate in the browser and Node. Here is its security profile and how to use it safely on untrusted compressed input.
LDAP Injection Explained With a Real Example
A walkthrough of a concrete LDAP injection example, why the filter syntax makes it dangerous, and how to detect and remediate it in real code.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.