Input validation

<input type="email" required>

# Серверная валидация (обязательна)
def create_user(name, email, age):
    if not name or len(name) > 100:
        raise ValidationError("Invalid name")
    if not re.match(r'^[^@]+@[^@]+\.[^@]+$', email):
        raise ValidationError("Invalid email")
    if age < 0 or age > 150:
        raise ValidationError("Invalid age")
    # создание пользователя

# Email
re.match(r'^[^@]+@[^@]+\.[^@]+$', email)

# Телефон (Россия)
re.match(r'^\+7\d{10}$', phone)

# Дата
re.match(r'^\d{4}-\d{2}-\d{2}$', date)

# UUID
re.match(r'^[0-9a-f]{8}-([0-9a-f]{4}-){3}[0-9a-f]{12}$', uuid)

ALLOWED_STATUSES = ['pending', 'active', 'blocked', 'deleted']

def validate_status(status):
    if status not in ALLOWED_STATUSES:
        raise ValidationError(f"Status must be one of {ALLOWED_STATUSES}")

def validate_order(shipping_address, billing_address):
    if not shipping_address and not billing_address:
        raise ValidationError("At least one address required")
    
    if shipping_address and not billing_address:
        # billing = shipping по умолчанию
        pass

{
    "error": "Validation failed",
    "code": "VALIDATION_ERROR",
    "details": {
        "name": ["Name is required", "Name is too long (max 100)"],
        "age": ["Age must be between 0 and 150"],
        "email": ["Invalid email format"]
    }
}

# Плохо (SQL инъекция)
user_input = request.GET['name']
query = f"SELECT * FROM users WHERE name = '{user_input}'"
# user_input = "'; DROP TABLE users; --"
# SELECT * FROM users WHERE name = ''; DROP TABLE users; --'

# Хорошо
cursor.execute("SELECT * FROM users WHERE name = %s", (user_input,))

# Django ORM
User.objects.filter(name=user_input)

# SQLAlchemy
session.query(User).filter(User.name == user_input)

import re
escaped = re.sub(r"['\"\\]", r"\\\g<0>", user_input)

# Плохо
comment = request.POST['comment']
# comment = "<script>alert('XSS')</script>"
return render(f"<div>{comment}</div>")

import html
safe_comment = html.escape(comment)
# <script>alert('XSS')</script>

<!-- Django auto-escapes by default -->
<div>{{ comment }}</div>

# Плохо
filename = request.GET['file']
# filename = "../../../etc/passwd"
with open(f"/var/www/uploads/{filename}") as f:
    return f.read()

import os

filename = request.GET['file']
base_dir = '/var/www/uploads'
safe_path = os.path.normpath(os.path.join(base_dir, filename))
if not safe_path.startswith(base_dir):
    raise ValidationError("Invalid path")

ALLOWED_FILES = ['avatar.jpg', 'logo.png', 'config.json']
if filename not in ALLOWED_FILES:
    raise ValidationError("File not allowed")

# Плохо
data = request.POST['data']  # может быть 100 MB
process(data)

# Nginx
client_max_body_size 10M;

# Django
DATA_UPLOAD_MAX_NUMBER_FIELDS = 1000
DATA_UPLOAD_MAX_NUMBER_FILES = 10

if len(name) > 100:
    raise ValidationError("Name too long")

def validate_json_depth(obj, max_depth=10, current_depth=0):
    if current_depth > max_depth:
        raise ValidationError("JSON too deep")
    if isinstance(obj, dict):
        for value in obj.values():
            validate_json_depth(value, max_depth, current_depth + 1)
    elif isinstance(obj, list):
        for item in obj:
            validate_json_depth(item, max_depth, current_depth + 1)

from pydantic import BaseModel, Field, validator, EmailStr

class UserCreate(BaseModel):
    name: str = Field(..., min_length=1, max_length=100)
    email: EmailStr
    age: int = Field(..., ge=0, le=150)
    tags: List[str] = Field(default_factory=list, max_items=10)
    
    @validator('name')
    def name_alphanumeric(cls, v):
        if not v.replace(' ', '').isalpha():
            raise ValueError('Name must contain only letters')
        return v

from django.core.validators import MinLengthValidator, MaxLengthValidator, MinValueValidator, MaxValueValidator
from django import forms

class UserForm(forms.Form):
    name = forms.CharField(min_length=1, max_length=100)
    email = forms.EmailField()
    age = forms.IntegerField(min_value=0, max_value=150)

const Joi = require('joi');

const schema = Joi.object({
    name: Joi.string().min(1).max(100).required(),
    email: Joi.string().email().required(),
    age: Joi.number().integer().min(0).max(150),
    tags: Joi.array().items(Joi.string()).max(10)
});

const { error, value } = schema.validate(req.body);
if (error) {
    return res.status(400).json({ error: error.details });
}

import { z } from 'zod';

const UserSchema = z.object({
    name: z.string().min(1).max(100),
    email: z.string().email(),
    age: z.number().int().min(0).max(150).optional(),
    tags: z.array(z.string()).max(10).default([])
});

const result = UserSchema.safeParse(req.body);
if (!result.success) {
    return res.status(400).json({ error: result.error });
}

import javax.validation.constraints.*;

public class UserCreate {
    @NotBlank @Size(min=1, max=100)
    private String name;
    
    @NotBlank @Email
    private String email;
    
    @Min(0) @Max(150)
    private int age;
    
    @Size(max=10)
    private List<@NotBlank String> tags;
}

// В контроллере
@PostMapping("/users")
public ResponseEntity<?> create(@Valid @RequestBody UserCreate user) {
    // ...
}

import bleach

# Удалить опасные HTML теги
safe_comment = bleach.clean(comment, tags=['b', 'i', 'p'], strip=True)

# Привести email к нижнему регистру
email = email.lower().strip()

# Обрезать пробелы
name = name.strip()

# Плохо (чёрный список)
BLOCKED = ['<script>', 'javascript:', 'onclick']
if any(bad in input for bad in BLOCKED):
    raise ValidationError("Invalid input")

# Хорошо (белый список)
ALLOWED = re.compile(r'^[a-zA-Z0-9\s\-_]+$')
if not ALLOWED.match(input):
    raise ValidationError("Invalid input")

@app.route('/users', methods=['POST'])
def create_user():
    data = request.get_json()
    
    # Валидация
    errors = validate_user(data)
    if errors:
        return {'errors': errors}, 422
    
    user = create_user_in_db(data)
    return user, 201

input CreateUserInput {
    name: String!
    email: String!
    age: Int
}

type Mutation {
    createUser(input: CreateUserInput!): User!
}

# Валидация в резолвере
def resolve_create_user(self, info, input):
    if len(input.name) > 100:
        raise GraphQLError("Name too long")
    # ...

message CreateUserRequest {
    string name = 1 [(validate.rules).string = {min_len: 1, max_len: 100}];
    string email = 2 [(validate.rules).string = {email: true}];
    int32 age = 3 [(validate.rules).int32 = {gte: 0, lte: 150}];
}

// Плохо (только на клиенте)
if (age < 0) alert("Age must be positive");

# Плохо
age = request.GET['age']  # строка "30"
if age < 18:  # Python сравнивает строки лексикографически "30" < "18"? нет
    # ...

# Хорошо
age = int(request.GET['age'])

# Плохо (не учитывает международные форматы)
if not re.match(r'^[A-Za-z]+$', name):
    raise ValidationError("Name must contain only Latin letters")

# Плохо
if not re.match(r'^[a-zA-Z]+$', name):
    # не пропустит "Иван"

# Хорошо
if not re.match(r'^[\w\s]+$', name, re.UNICODE):

# Плохо (SQL инъекция)
query = f"SELECT * FROM users WHERE id = {user_id}"
# user_id = "1 OR 1=1"

# Хорошо
cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))