CWE-20 Improper Input Validation

Coverage: 6 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 6 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged inputs that are used without adequate validation (type/format/range/allowlists). This is a "root cause" category that often leads to injection, authorization bypass, or data corruption.

Why it matters

Unvalidated input can trigger injection, logic bypass, or data corruption.

• Injection (SQL/command/XSS) when dangerous characters/structures aren't constrained.
• Logic bypass when required fields or ranges aren't enforced.
• DoS when input sizes are unbounded (see CWE-400 / INPUT01/02).

Safer examples

1) Validate with schemas/DTOs (recommended)

Use strict schemas that reject unknown fields and enforce types and bounds.

2) Use allowlists for identifiers and enums

If a value should be one of {A,B,C}, enforce that explicitly.

3) Validate at trust boundaries

Validate at the point you accept input (HTTP handlers, CLI args, webhooks), not deep inside business logic.

How SiteShadow detects it (high level)

• Flags risky sinks that consume request-derived input without nearby validation.
• Detects "unchecked" conversions and missing bounds checks in common patterns.

References

• CWE-20: https://cwe.mitre.org/data/definitions/20.html

---

← Back to Vulnerability Library