input-validation

name	input-validation
description	Use when: validate and sanitize untrusted input at boundaries to prevent bad data and attacks.

Goal: reject or normalize untrusted input before it reaches logic.

Use for:

• handling user input, request bodies, and external data
• preventing injection and corrupt-state bugs
• defining a schema and rules at the boundary

Workflow:

1. Validate at the trust boundary, as early as possible.
2. Use an allowlist: accept known-good, reject the rest.
3. Check type, range, format, and length explicitly.
4. Normalize encoding before validating to avoid bypasses.
5. Return clear, specific validation errors.
6. Encode output for its destination context separately.

Patterns:

• schema validation for structured payloads
• allowlist over blocklist
• parse into typed values, do not pass raw strings around
• separate validation from business logic

Rules:

• never trust input; validate every external boundary
• prefer allowlists; blocklists miss cases
• validation is not a substitute for parameterized queries/encoding
• fail with specific, non-leaky error messages