SCP01 Input Validation
What this means
SiteShadow flagged missing or insufficient input validation. "Input" includes request bodies, query params, headers, files, webhooks, and any data coming from other systems.
Why it matters
Bad input handling is a root cause for many vulnerabilities.
- Injection (SQL, command, LDAP/XPath) when untrusted strings reach interpreters.
- Authorization and logic bypass when "critical state" is client-controlled.
- DoS and crashes when inputs are unexpectedly large or malformed.
Safer examples
1) Validate request payloads with a schema (TypeScript)
import { z } from "zod";
const CreateUser = z.object({
email: z.string().email(),
displayName: z.string().min(1).max(64),
});
const data = CreateUser.parse(req.body);2) Validate IDs with allowlists (Python)
import re
if not re.fullmatch(r"[a-zA-Z0-9_-]{1,64}", user_id):
raise ValueError("Invalid user_id")3) Enforce size limits early
Reject oversized requests/uploads before parsing (see INPUT01-02 / CWE-400).
How SiteShadow detects it (high level)
- Detects untrusted sources (requests/files/network) flowing into sensitive sinks (DB, filesystem, execution, templates).
- Flags missing schema/allowlist/range checks near those flows.
References
- OWASP Secure Coding Practices: https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/
---