input-validation
Safeguard articles tagged "input-validation" — guides, analysis, and best practices for software supply chain and application security.
62 articles
pako on npm: Security Review and Safe Usage of the zlib Port
pako is a fast JavaScript port of zlib used for gzip and deflate in the browser and Node. Here is its security profile and how to use it safely on untrusted compressed input.
LDAP Injection Explained With a Real Example
A walkthrough of a concrete LDAP injection example, why the filter syntax makes it dangerous, and how to detect and remediate it in real code.
Java URL Decode: Doing It Safely Without Opening Holes
Java URL decode looks trivial until you hit double-decoding and encoding mismatches. Here is how to decode URLs in Java correctly and where the security bugs hide.
JavaScript Injection Attacks: Types and Prevention
JavaScript injection covers a family of attacks where untrusted input becomes executable code or markup in the browser. Here are the types and the concrete defenses for each.
XXE Attack Example: How XML External Entity Injection Works and How to Stop It
A defensive XXE attack example that explains how XML External Entity injection abuses parsers, what it can expose, and the parser settings that shut it down.
papaparse npm: Security Review and Best Practices
PapaParse is the go-to CSV parser for JavaScript, but older versions carry a ReDoS flaw. Here is a security review and how to use it safely on untrusted files.
SQL Injection Commands Explained: How the Attack Works and How to Stop It
Understanding the SQL injection commands attackers rely on is the fastest way to learn how to defend against them. This guide explains the classes conceptually and focuses on detection and remediation.
JavaScript Injection Attack: How It Works and How to Stop It
A JavaScript injection attack runs attacker-controlled script in a victim's browser or a Node.js process. Here is how the attack class works and the defenses that actually neutralize it.
Java URL Encode: How to Encode URLs Safely Without Introducing Bugs
The Java URL encode API is easy to reach for and easy to misuse. Here is when to use URLEncoder, when to use URI, and how the wrong choice becomes an injection risk.
What Is a Code Injection Attack and How Do You Prevent It?
A code injection attack tricks an application into running attacker-supplied code as if it were trusted. Here is how the class works and how to shut it down.
How to Use the express-validator npm Package Safely
A security-focused review of the express-validator npm package: what it protects you from, what it does not, and how to configure it so bad input never reaches your handlers.
XSS Attack Examples: How Cross-Site Scripting Works and How to Stop It
Walk through realistic XSS attack examples across the three main flavors of cross-site scripting, then see how to detect and remediate each one.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.