Injection, SSRF & Input Validation

SQL injection

Untrusted input concatenated into SQL:

Fix: parameterized queries / prepared statements always.

ORM doesn't save you if you use raw queries or sort from user input unsanitized.

NoSQL injection

MongoDB: {"$gt": ""} in JSON body bypasses password check.

Validate types; use schema validation; don't pass user objects directly to query builders.

Command injection

os.system("convert " + filename) — filename ; rm -rf /

Use library APIs; never shell with user input.

SSRF — server-side request forgery

Your server fetches user-supplied URL → attacker hits internal metadata (169.254.169.254), internal admin panels.

Mitigations:

• Allowlist domains (weak alone)
• Block private IP ranges (RFC1918, link-local)
• Egress firewall / network policies
• No redirects to internal hosts

Common in: webhooks, PDF renderers, image proxies, CI "clone repo" features.

Input validation at boundary

• Schema validation — JSON Schema, protobuf, Zod at API edge
• Size limits — max body, max array length, max recursion
• Type coercion — reject don't silently cast

Validate early; business rules deeper.

Prototype pollution (JS)

merge(userInput, defaults) — attacker sets __proto__.

Use safe merge libraries; Object.create(null) for maps; validate keys.

Mass assignment

User.update(request.json) — attacker sets is_admin: true.

Allowlist updatable fields explicitly.

Cross-reference: LLD → API & Component Design for validation placement in class design.