# Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (CWE-74)

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

**Stack:** Python

- Prevalence: Alta Frecuentemente explotada
- Impact: Alto 3 reglas de severidad alta
- Prevention: Documentada 3 ejemplos de corrección

**OWASP:** Injection (A03:2021-Injection) - #3

## Description

Software has certain assumptions about what constitutes data and control. Injection problems occur when these assumptions are violated. Attackers exploit this by inserting special characters or instructions that modify the intended interpretation.

## Prevention

Estrategias de prevención para Injection basadas en 1 reglas de detección de Shoulder.

### Python

Use system prompts, input sanitization, and length limits for user input to AI models

## Warning Signs

- [HIGH] untrusted user input flowing directly into AI/LLM prompts without
sanitization

## Consequences

- Ejecutar código no autorizado
- Leer datos de la aplicación
- Modificar datos de la aplicación
- Eludir mecanismo de protección

## Mitigations

- Usa interfaces parametrizadas que separen el código de los datos
- Valida y codifica toda la entrada antes de usarla en componentes downstream
- Usa listas de permitidos para validar entrada siempre que sea posible

## Detection

- Total rules: 3
- Languages: go, javascript, typescript, python

## Rules by Language

### Python (1 rules)

- **AI Prompt Injection** [HIGH]: Detects untrusted user input flowing directly into AI/LLM prompts without
sanitization.
  - Remediation: Use system prompts and sanitize user input before including in prompts.

```python
messages=[
    {'role': 'system', 'content': 'You are a helpful assistant.'},
    {'role': 'user', 'content': sanitized_input}
]
```

Learn more: https://shoulder.dev/learn/python/cwe-74/prompt-injection