input-validation
Safeguard articles tagged "input-validation" — guides, analysis, and best practices for software supply chain and application security.
62 articles
Java URL Decode: Doing It Safely Without Opening Holes
Java URL decode looks trivial until you hit double-decoding and encoding mismatches. Here is how to decode URLs in Java correctly and where the security bugs hide.
JavaScript Injection Attacks: Types and Prevention
JavaScript injection covers a family of attacks where untrusted input becomes executable code or markup in the browser. Here are the types and the concrete defenses for each.
XXE Attack Example: How XML External Entity Injection Works and How to Stop It
A defensive XXE attack example that explains how XML External Entity injection abuses parsers, what it can expose, and the parser settings that shut it down.
papaparse npm: Security Review and Best Practices
PapaParse is the go-to CSV parser for JavaScript, but older versions carry a ReDoS flaw. Here is a security review and how to use it safely on untrusted files.
SQL Injection Commands Explained: How the Attack Works and How to Stop It
Understanding the SQL injection commands attackers rely on is the fastest way to learn how to defend against them. This guide explains the classes conceptually and focuses on detection and remediation.
JavaScript Injection Attack: How It Works and How to Stop It
A JavaScript injection attack runs attacker-controlled script in a victim's browser or a Node.js process. Here is how the attack class works and the defenses that actually neutralize it.
Java URL Encode: How to Encode URLs Safely Without Introducing Bugs
The Java URL encode API is easy to reach for and easy to misuse. Here is when to use URLEncoder, when to use URI, and how the wrong choice becomes an injection risk.
How to Use the express-validator npm Package Safely
A security-focused review of the express-validator npm package: what it protects you from, what it does not, and how to configure it so bad input never reaches your handlers.
What Is a Code Injection Attack and How Do You Prevent It?
A code injection attack tricks an application into running attacker-supplied code as if it were trusted. Here is how the class works and how to shut it down.
XSS Attack Examples: How Cross-Site Scripting Works and How to Stop It
Walk through realistic XSS attack examples across the three main flavors of cross-site scripting, then see how to detect and remediate each one.
Open Redirect Vulnerabilities: What They Are and How to Fix Them
An open redirect vulnerability fix is usually a ten-line change, but the bug keeps shipping because redirects hide in login flows, tracking links, and OAuth callbacks. Here is how to find and close them.
class-validator: Security, Health, and Safe Usage in Production
class-validator powers input validation in most NestJS apps, but its defaults burned teams once before. Here is its real security history and how to configure it safely.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.