input-validation

Validating external input data across trust boundaries requires checking HTTP requests, database reads, and environment variables for type, range, format, and length. This process identifies interfaces where less-trusted data enters and applies pattern matching to enforce code security.

Trust boundary security is the practice of validating data type, range, format, and length when it crosses from less-trusted sources into your process. You need it when processing external inputs from HTTP APIs, database interactions, and command-line operations to prevent missing schemas and unbounded reads.

Scanning a code diff for input validation and command injection vulnerabilities involves running an analysis script against your diff file. This checks for path operations on user-supplied paths and categorizes potential security issues into critical, high, medium, and low severity levels.

Yes, this input validation approach works with HTTP APIs and environment variables. It applies type checking, format validation, and range analysis to environments where external data is processed, including HTTP requests, database reads, and command-line operations.

Pattern matching for data validation requires input analysis libraries and focuses on type, range, format, and length checks. It is limited to identifying high-signal vulnerabilities like missing schemas and unbounded reads, categorizing them into severity levels rather than automatically patching the code.