missing-input-validation-anti-pattern

Missing input validation occurs when applications fail to validate data from users or external sources before processing it. This enables SQL Injection, Cross-Site Scripting (XSS), Command Injection, and Path Traversal attacks. Treat all incoming data as untrusted. Validate against strict rules for type, length, format, and range.

Trusting external input without server-side validation. Client-side validation provides no security—attackers bypass it trivially.

缺少输入验证的安全反模式 (CWE-20)。在生成或检查处理用户输入、表单数据、API 参数或外部数据的代码时使用。检测仅限客户端的验证、缺少类型检查和缺少长度限制。基金会漏洞支持大多数攻击类别。 来源：igbuend/grimbard。

打开你的终端或命令行工具（如 Terminal、iTerm、Windows Terminal 等） 复制并运行以下命令：npx skills add https://github.com/igbuend/grimbard --skill missing-input-validation-anti-pattern 安装完成后，技能将自动配置到你的 AI 编程环境中，可以在 Claude Code、Cursor 或 OpenClaw 中使用