zakirkun Insufficient Business Logic Input Validation
Overview
Beyond injection and type checking, business logic requires semantic validation:
- Age/date fields must be realistic (no future birthdays for adults)
- Email domain validation (company domains for B2B)
- Geolocation consistency (billing address matches IP country)
- Field length limits on free-text fields to prevent DoS
Remediation
- Implement domain-specific validation for each business field
- Define and enforce explicit validation rules at the controller layer
- Use validation libraries with schema definitions