Skip to main content

​
user-input-not-validated

Low What it is Input fields accept data that violates the expected type, format, or length — such as letters in a numeric field, non-email strings in an email field, or extremely long strings in a text field with no length limit. Why it matters Missing input validation can cause:
  • Application errors when invalid data reaches downstream processing
  • Database constraint violations
  • Unexpected behavior in business logic
  • In some cases, performance issues from extremely long inputs
While lower severity than injection vulnerabilities, invalid inputs can trigger unexpected server behavior that aids further exploitation. How QAOS detects it The agent identifies form fields and submits type-mismatched, boundary-value, and special character payloads, observing whether the application accepts or rejects them:
  • Numeric fields: submitting letters and special characters
  • Email fields: submitting strings without @
  • Text fields: submitting extremely long strings (10,000+ characters)
  • Bounded fields: submitting values at and beyond stated limits
Examples 
Age field: "twenty-five"        ← letters in numeric field
Email field: "notanemail"       ← missing @ symbol
Phone field: "+1 DROP TABLE"    ← special characters
Comment field: "A" * 50000      ← extremely long string
How to fix Validate all inputs both client-side (for immediate user feedback) and server-side (for security). Client-side validation alone is never sufficient. 
// HTML5 built-in validation
<input type="number" min="0" max="150" required>
<input type="email" required>
<input type="text" maxlength="500">

// Server-side validation with Zod (TypeScript)
const schema = z.object({
  age: z.number().int().min(0).max(150),
  email: z.string().email(),
  comment: z.string().max(500)
})

// Python with Pydantic
class UserInput(BaseModel):
    age: int = Field(ge=0, le=150)
    email: EmailStr
    comment: str = Field(max_length=500)
Return clear, specific error messages when validation fails so users know what to correct.