XSS, SQL injection, and command injection prevention patterns for the Next.js frontend and FastAPI backend. Covers output encoding, parameterised queries, and OWASP Top 10 input handling.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
XSS, SQL injection, and command injection prevention patterns for the Next.js frontend and FastAPI backend. Covers output encoding, parameterised queries, and OWASP Top 10 input handling.
Defence-in-depth patterns preventing injection attacks across the full stack. Complements data-validation (which checks shape/type) by ensuring data is safe for its destination context (HTML, SQL, shell, URL).
Description
Covers XSS, SQL injection, command injection, URL redirect, and SSRF prevention patterns for the Next.js frontend and FastAPI backend. Enforces output encoding, parameterised queries, and safe subprocess handling aligned with OWASP Top 10 guidelines.
When to Apply
Positive Triggers
Rendering user-generated content in HTML
Constructing database queries with user input
Building shell commands or subprocess calls
Handling URL parameters or redirect targets
Reviewing code for OWASP Top 10 vulnerabilities
User mentions: "XSS", "injection", "sanitise", "security", "escape", "OWASP"
Negative Triggers
Validating data shape or type (use data-validation instead)
Untrusted data in shell commands can execute arbitrary system commands.
Safe Subprocess Calls
import subprocess
import shlex
# SAFE: List form (no shell interpretation)
subprocess.run(
["git", "log", "--oneline", "-n", str(count)],
capture_output=True, text=True
)
# SAFE: shlex.quote for unavoidable string commands
filename = shlex.quote(user_filename)
subprocess.run(f"wc -l {filename}", shell=True)
Dangerous Patterns (NEVER USE)
# DANGEROUS: Unquoted user input in shell
subprocess.run(f"cat {user_input}", shell=True)
# DANGEROUS: os.system with user inputimport os
os.system(f"rm {filename}")
Detection Rule
rg "os\.system\(|shell=True" apps/backend/src/
Attack Vector 4: URL/Redirect Injection
The Threat
Open redirects allow attackers to redirect users to malicious sites after login.
Command injection prevention verified (no shell=True with user input)
OWASP Top 10 input handling coverage reviewed
Redirect URLs validated against an allow-list
CSP headers configured in next.config.ts
Response Format
[AGENT_ACTIVATED]: Input Sanitisation
[PHASE]: {Audit | Implementation | Review}
[STATUS]: {in_progress | complete}
{security analysis or implementation guidance}
[NEXT_ACTION]: {what to do next}
Integration Points
Data Validation
data-validation runs first (checks shape), then input-sanitisation ensures safety:
Input → data-validation (is it valid?) → input-sanitisation (is it safe?) → Use
Error Taxonomy
Sanitisation failures should use AUTH_PERMISSION_* or DATA_VALIDATION_* error codes. Never reveal internal details in error messages to untrusted clients.
Council of Logic (Turing Check)
Sanitisation functions must be O(n) — no recursive regex or backtracking patterns that could cause ReDoS (Regular Expression Denial of Service).
Australian Localisation (en-AU)
Spelling: sanitisation, authorisation, defence, analyse, centre, colour
Compliance: Privacy Act 1988, Australian Cyber Security Centre (ACSC) guidelines
Tone: Direct, security-conscious — state risks clearly
