# Improper Input Validation (CWE-20)

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

**Stack:** JavaScript

- Prevalence: 높음 자주 악용됨
- Impact: 높음 6개의 높은 심각도 규칙
- Prevention: 문서화됨 13개의 수정 예시

**OWASP:** Broken Access Control (A01:2021-Broken Access Control) - #1

## Description

Input validation is a frequently-used technique for checking potentially dangerous inputs in order to ensure that the inputs are safe for processing within the code, or when communicating with other components. When software does not validate input properly, an attacker is able to craft the input in a form that is not expected by the rest of the application.

## Prevention

7개의 Shoulder 탐지 규칙을 기반으로 한 Improper Input Validation 예방 전략.

### JavaScript

Validate business-critical inputs with range checks before processing

Use server-side prices from the database and validate ranges for business-critical values

Add class-validator decorators to all DTO properties and enable the global ValidationPipe

## Warning Signs

- [HIGH] Business-critical value extracted from user input without validation.
This could allow attackers to manipulate prices, d
- [HIGH] business-critical values from user input used without validation
- [HIGH] DTO class '...' used in controller but lacks class-validator decorators. Unvalidated input may lead to injection attacks
- [HIGH] Prisma ... uses unvalidated user input. Validate and whitelist fields before passing to Prisma.
- [HIGH] Context creation uses raw request data without validation. Verify and validate all request data before adding to context
- [HIGH] Procedure '...' accepts user input but lacks .input() validation. Add Zod schema to validate runtime data.
- [HIGH] Entity '...' accepts user input but lacks class-validator decorators. Add validation to prevent invalid data.
- [MEDIUM] business-critical values (discount, refund, quantity) used without validation

## Consequences

- 승인되지 않은 코드 실행
- 애플리케이션 데이터 수정
- DoS
- 애플리케이션 데이터 읽기

## Mitigations

- 모든 입력이 악의적이라고 가정하세요. 알려진 안전한 입력만 허용하는 검증 전략을 사용하세요
- 입력 검증 시 관련될 수 있는 모든 속성을 고려하세요
- 악성 또는 잘못된 형식의 입력을 찾는 것에만 의존하지 마세요

## Detection

- Total rules: 13
- Languages: python, go, javascript, typescript

## Rules by Language

### Javascript (7 rules)

- **Business Logic Input Validation** [MEDIUM]: Detects business-critical values (discount, refund, quantity) used without validation.
  - Remediation: Validate business-critical inputs before use.

```javascript
function validateDiscount(discount) {
  const value = parseFloat(discount);
  if (isNaN(value) || value < 0 || value > 100) {
    throw new Error('Discount must be 0-100');
  }
  return value;
}

const validated = validateDiscount(req.body.discount);
applyDiscount(validated);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-20/business-logic-input-validation
- **Unvalidated Business-Critical Values** [HIGH]: Detects business-critical values from user input used without validation.
  - Remediation: Use server-side prices and validate ranges before use.

```javascript
const product = products.get(productId);
const total = product.price * quantity;
```

Learn more: https://shoulder.dev/learn/javascript/cwe-20/unvalidated-business-values
- **NestJS DTO Missing Validation Decorators** [HIGH]: DTOs without class-validator decorators allow unvalidated input to flow into
the application, enabling injection and data corruption.
  - Remediation: Add class-validator decorators to DTO properties.

```typescript
import { IsString, IsEmail, MinLength } from 'class-validator';

class CreateUserDTO {
  @IsString()
  @MinLength(3)
  username: string;

  @IsEmail()
  email: string;
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/dto-missing-validation
- **Prisma Missing Input Validation** [HIGH]: Passing req.body directly to Prisma where/data allows users to filter by
unauthorized fields and bypass access controls.
  - Remediation: Validate and whitelist fields with Zod before Prisma queries.

```typescript
import { z } from 'zod';

const getUsersInput = z.object({
  role: z.enum(['user', 'moderator']).optional(),
  status: z.enum(['active', 'inactive']).optional()
});

async function getUsers(req: Request) {
  const input = getUsersInput.parse(req.query);
  return await prisma.user.findMany({ where: input });
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/prisma-missing-input-validation
- **tRPC Unsafe Context Usage** [HIGH]: Using unvalidated headers, cookies, or query params in context creation allows
attackers to bypass authentication and impersonate users.
  - Remediation: Verify JWT signatures or use session libraries instead of trusting raw headers.

```typescript
import { getServerSession } from 'next-auth';

export async function createContext({ req, res }: CreateNextContextOptions) {
  const session = await getServerSession(req, res, authOptions);
  return {
    user: session?.user ?? null,
    db
  };
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/context-injection
- **tRPC Procedure Missing Input Validation** [HIGH]: tRPC procedures without .input() validation accept unvalidated payloads at
runtime, enabling injection and type confusion attacks.
  - Remediation: Add Zod schema validation with .input() to all procedures.

```typescript
import { z } from 'zod';

export const userRouter = router({
  getUser: publicProcedure
    .input(z.object({
      userId: z.number().int().positive()
    }))
    .query(async ({ input }) => {
      return await db.user.findUnique({ where: { id: input.userId } });
    })
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/missing-input-validation
- **TypeORM Entity Missing Validation** [HIGH]: TypeORM entities without class-validator decorators accept any data, enabling
injection attacks and data integrity violations.
  - Remediation: Add class-validator decorators to all entity properties.

```typescript
import { IsEmail, IsString, MinLength, Max } from 'class-validator';

@Entity()
export class User {
  @Column()
  @IsEmail()
  email: string;

  @Column()
  @IsString()
  @MinLength(3)
  username: string;
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/entity-validation-missing

### Typescript (7 rules)

- **Business Logic Input Validation** [MEDIUM]: Detects business-critical values (discount, refund, quantity) used without validation.
  - Remediation: Validate business-critical inputs before use.

```javascript
function validateDiscount(discount) {
  const value = parseFloat(discount);
  if (isNaN(value) || value < 0 || value > 100) {
    throw new Error('Discount must be 0-100');
  }
  return value;
}

const validated = validateDiscount(req.body.discount);
applyDiscount(validated);
```

Learn more: https://shoulder.dev/learn/javascript/cwe-20/business-logic-input-validation
- **Unvalidated Business-Critical Values** [HIGH]: Detects business-critical values from user input used without validation.
  - Remediation: Use server-side prices and validate ranges before use.

```javascript
const product = products.get(productId);
const total = product.price * quantity;
```

Learn more: https://shoulder.dev/learn/javascript/cwe-20/unvalidated-business-values
- **NestJS DTO Missing Validation Decorators** [HIGH]: DTOs without class-validator decorators allow unvalidated input to flow into
the application, enabling injection and data corruption.
  - Remediation: Add class-validator decorators to DTO properties.

```typescript
import { IsString, IsEmail, MinLength } from 'class-validator';

class CreateUserDTO {
  @IsString()
  @MinLength(3)
  username: string;

  @IsEmail()
  email: string;
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/dto-missing-validation
- **Prisma Missing Input Validation** [HIGH]: Passing req.body directly to Prisma where/data allows users to filter by
unauthorized fields and bypass access controls.
  - Remediation: Validate and whitelist fields with Zod before Prisma queries.

```typescript
import { z } from 'zod';

const getUsersInput = z.object({
  role: z.enum(['user', 'moderator']).optional(),
  status: z.enum(['active', 'inactive']).optional()
});

async function getUsers(req: Request) {
  const input = getUsersInput.parse(req.query);
  return await prisma.user.findMany({ where: input });
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/prisma-missing-input-validation
- **tRPC Unsafe Context Usage** [HIGH]: Using unvalidated headers, cookies, or query params in context creation allows
attackers to bypass authentication and impersonate users.
  - Remediation: Verify JWT signatures or use session libraries instead of trusting raw headers.

```typescript
import { getServerSession } from 'next-auth';

export async function createContext({ req, res }: CreateNextContextOptions) {
  const session = await getServerSession(req, res, authOptions);
  return {
    user: session?.user ?? null,
    db
  };
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/context-injection
- **tRPC Procedure Missing Input Validation** [HIGH]: tRPC procedures without .input() validation accept unvalidated payloads at
runtime, enabling injection and type confusion attacks.
  - Remediation: Add Zod schema validation with .input() to all procedures.

```typescript
import { z } from 'zod';

export const userRouter = router({
  getUser: publicProcedure
    .input(z.object({
      userId: z.number().int().positive()
    }))
    .query(async ({ input }) => {
      return await db.user.findUnique({ where: { id: input.userId } });
    })
});
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/missing-input-validation
- **TypeORM Entity Missing Validation** [HIGH]: TypeORM entities without class-validator decorators accept any data, enabling
injection attacks and data integrity violations.
  - Remediation: Add class-validator decorators to all entity properties.

```typescript
import { IsEmail, IsString, MinLength, Max } from 'class-validator';

@Entity()
export class User {
  @Column()
  @IsEmail()
  email: string;

  @Column()
  @IsString()
  @MinLength(3)
  username: string;
}
```

Learn more: https://shoulder.dev/learn/typescript/cwe-20/entity-validation-missing