Security Test: Improper Input Validation Injection¶

Description¶

Default Severity: high

Improper input validation injection happens when an application blindly accepts and processes user-supplied data without adequately checking it first. This oversight allows an attacker to insert harmful code—like malicious scripts—into the application, potentially tricking it into running that code. The risk here is that if such vulnerabilities are exploited, sensitive data could be stolen, sessions hijacked, or the app’s behavior manipulated. Developers often fall into pitfalls by not sanitizing inputs, assuming users won’t provide harmful data, or misusing trusted functions, leaving the door open for attackers to misuse.

Reference:

• https://portswigger.net/web-security/cross-site-scripting

Configuration¶

Identifier: injection/improper_input

Examples¶

All configuration available:

checks:
  injection/improper_input:
    skip: false # default
    options:
      skip_objects: # cf. Options below

Options¶

Options can be set in the options key of the Security Test Configuration.

Compliance and Standards¶