Input validation and parsing discipline (djb "don't parse" + Margaret Hamilton's defensive design) for wings. Use when writing or changing any code that reads catalogs, templates, flex blocks, URLs, env vars, fetch responses, js.Values, or webdev-supplied attributes.
Installation
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Input validation and parsing discipline (djb "don't parse" + Margaret Hamilton's defensive design) for wings. Use when writing or changing any code that reads catalogs, templates, flex blocks, URLs, env vars, fetch responses, js.Values, or webdev-supplied attributes.
Hostile Input & Parsing Discipline
Two converging sources:
djb: parsing is where security bugs concentrate. Avoid parsing; when
unavoidable, parse once, at the boundary, into a typed structure, and let
interior code consume only the typed result. Prefer formats too simple to
misparse.
Margaret Hamilton (Apollo): "the operator is trained and won't make
mistakes" is not a defense. Her prelaunch-program bug report was dismissed
on exactly that argument — then Jim Lovell triggered it on Apollo 8 (P01
wipe). Validate everyone's input: end users, webdevs, and our own build
artifacts.
Rules
Parse at the trust boundary, never again. Each input crosses exactly
one validator that produces a typed Go value. Downstream functions take
the typed value, not the raw string. If a function deep in the call tree
does strings.Split on data that arrived from outside, the boundary
leaked.
Reject, don't repair. Malformed input → typed error and stop
(feedback_errors_over_panic: public API returns error; the app dev
decides whether to panic). Fixing up input silently creates two parsers:
the real one and the one in the attacker's head. Documented exception:
expr.ParseFlexBlock leniency deliberately falls back to literal
passthrough (render-as-text), which is a fail-closed default, not repair.
Prefer dumb formats. JSON via encoding/json into a concrete struct
(DisallowUnknownFields when the schema is closed) beats any hand-rolled
format. If you design a format, make it a fixed shape, not a language.
Validate the meaning, not just the shape. BCP-47 tags go through the
guard (don't interpolate raw lang strings into URLs/paths); indices into
catalogs are bounds-checked; file paths from config are cleaned and
confined to the expected root (the dev server's dotfile/key blocking in
cmd/build is the model).
Webdev input is input. Template attributes, binding names, wings.json,
WINGS_* env vars. Silent failure is the worst outcome — the camelCase
binding lint in cmd/build/lint.go exists because the HTML parser
lowercases attribute names and the mismatch failed silently. New
template-facing features must either work or fail the build with
file:line; never render wrong quietly.
wings trust boundaries (audit points)
Boundary
Validator
Catalog JSON + .sig fetched at runtime
wi18n/verify.go (ed25519, fail-closed when key set)
