CD-SEC-08 - Injection Handling Failures
Apps dynamically query data from user input without sanitization, often using platform-specific syntax.
Intent & Description
'
🎯 Intent
Prevent injection attacks through inadequate input sanitization in low-code/no-code platforms.
📋 Context
Apps dynamically query data from user input without sanitization — a classic AppSec problem, made worse by the fact that LCNC platforms often have their own proprietary syntax for referencing internal data, which standard input-sanitization libraries don’t know to account for.
💡 Solution
Implement input sanitization that accounts for the specific operations performed on that input (SQL, platform-native syntax, macro execution, etc.). Use parameterized queries and stored procedures where possible. Platform vendors must sanitize their own proprietary syntax, not just standard injection vectors. Apply input validation and allowlisting.'
Real-world Use Case
Source
📌 TL;DR
Sanitize inputs for platform-specific syntax. Use parameterized queries, implement proper validation, and account for proprietary injection vectors.
Advantages
- Prevents injection attacks
- Protects against platform-specific vectors
- Enables data security
- Supports compliance requirements
Disadvantages
- Platform-specific sanitization complexity
- May require vendor cooperation
- Input validation maintenance