CWE-20 Improper Input Validation
What this means
SiteShadow flagged inputs that are used without adequate validation (type/format/range/allowlists). This is a "root cause" category that often leads to injection, authorization bypass, or data corruption.
Why it matters
Unvalidated input can trigger injection, logic bypass, or data corruption.
- Injection (SQL/command/XSS) when dangerous characters/structures aren't constrained.
- Logic bypass when required fields or ranges aren't enforced.
- DoS when input sizes are unbounded (see
CWE-400/INPUT01/02).
Safer examples
1) Validate with schemas/DTOs (recommended)
Use strict schemas that reject unknown fields and enforce types and bounds.
2) Use allowlists for identifiers and enums
If a value should be one of {A,B,C}, enforce that explicitly.
3) Validate at trust boundaries
Validate at the point you accept input (HTTP handlers, CLI args, webhooks), not deep inside business logic.
How SiteShadow detects it (high level)
- Flags risky sinks that consume request-derived input without nearby validation.
- Detects "unchecked" conversions and missing bounds checks in common patterns.
References
- CWE-20: https://cwe.mitre.org/data/definitions/20.html
---