Information Input Validation | Injection Prevention ¶

1. Purpose and Scope ¶

To prevent untrusted data from being interpreted as executable code during application processing, thereby mitigating SQL injection, command injection, and script injection risks.

Support STIG compliance with SI-10-06.

2. MyBatis SQL Injection Prevention ¶

Use #{} for parameter binding
Do not use ${} with user input

The following section provides representative code examples from the project.

SELECT zone_name from mct_zone_template where zone_type = #{zoneType}

INSERT INTO mct_server (server_id, zone_id, server_ip, server_type, server_hostname, server_field1,
     server_field2, server_field3, server_field4, server_field5, server_field6, key_server,svrtype,is_from_du,instance_type,vip_name,pool_id,pool_sys_id)
     VALUES (#{serverId}, #{zoneId}, #{serverIp,jdbcType=VARCHAR},#{serverType},#{serverHostname,jdbcType=VARCHAR},
     #{serverField1},#{serverField2},#{serverField3},#{serverField4},#{serverField5},#{serverField6},#{keyServer},#{svrType,jdbcType=VARCHAR},#{isFromDU},#{instanceType},#{vipName},#{poolId},#{poolSysId})

delete mct_server_parameter where server_id = #{serverId}

We enforce strict ORM standards in this area. For detailed guidelines, please refer to: Use #{}, #param# instead of ${} with parameters in xml configuration - [Mandatory]

3. Spring Boot Input Validation ¶

Use DTO objects with @Validate annotations
Enforce length and format constraints

@Inherited
@Target(ElementType.METHOD)
@Retention(RetentionPolicy.RUNTIME)
public @interface Validate {
    ValidationType[] value();
}

    NULL(null),
    STRING(new StringValidator()),
    STRING_NO_NULL(new StringValidator(false)),
    STRING_200(new StringValidator(200)),
    STRING_120(new StringValidator(120)),
    STRING_20(new StringValidator(20)),
    STRING_50(new StringValidator(50)),
    STRING_80(new StringValidator(80)),
    STRING_YYYYMMDD(new StringDateValidator(StringDateValidator.YYYYMMDD)),
    STRING_YYYYMMDDNU(new StringDateValidator(StringDateValidator.YYYYMMDD, true)),
    LONG(new LongValidator()),
    LONG_5(new LongValidator(5)),
    LONG_LIST(new LongListValidator()),
    IP(new RegexValidator("^(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])\\.(\\d{1,2}|1\\d\\d|2[0-4]\\d|25[0-5])$", "illegal ip address")),
    TIME(new TimeValidator("yyyy-MM-dd HH:mm:ss")),
    WRITESTATUS_ITEMS(new WriteStatusValidator()),
    MULTI_WRITESTATUS_ITEMS(new WriteStatusMultiValidator()),
    AGENTGROUP(new AgentGroupValidator()),
    COLLECTION_NOT_EMPTY(new CollectionNotEmptyValidator()),
    TARGET_TEST_SERVER(new TargetTestServerValidator()),
    Boolean_NOT_NULL(new BooleanValidator()),
    GWHITELIST(new GWhiteListValidator());

Input validation is a supplementary measure and not the primary mechanism for preventing injection attacks.

4. Vue3 Output Encoding and XSS Prevention ¶

Vue automatically escapes HTML special characters, preventing script execution.
Ensure that all user-supplied or external data rendered in the front-end is not interpreted as executable code by the browser, thereby preventing Cross-Site Scripting (XSS).

<script> -> &lt;script&gt;

<template>
  <div>{{ username }}</div>
</template>

5. Summary ¶

The project enforces injection prevention by separating data from executable logic using parameterized interfaces and context-aware output encoding. Controls are applied across database interactions and front-end rendering, and are aligned with the SI-10 Information Input Validation baseline.