input-sanitization

Input Sanitization

All external input is untrusted. Sanitize at system boundaries.

Validation vs Sanitization

Concept	Purpose	Example
Validation	Reject invalid input	Email must match pattern
Sanitization	Transform to safe form	Strip HTML tags, escape chars

String Inputs

public static class StringSanitizer
{
    public static string Sanitize(string? input, int maxLength = 1000)
    {
        if (string.IsNullOrWhiteSpace(input))
            return string.Empty;

        return input
            .Trim()
            .Normalize(NormalizationForm.FormC)
            .Truncate(maxLength);
    }
}

Rules:

• Trim whitespace
• Normalize Unicode (NFC)
• Enforce maximum length
• Remove control characters
• Use allowlist of permitted characters when possible

SQL Injection Prevention

// CORRECT - Parameterized query
var user = await context.Users
    .FirstOrDefaultAsync(u => u.Email == email, ct);

// CORRECT - Raw SQL with parameters
var users = await context.Users
    .FromSqlInterpolated($"SELECT * FROM Users WHERE Email = {email}")
    .ToListAsync(ct);

// NEVER - String concatenation
var users = await context.Users
    .FromSqlRaw($"SELECT * FROM Users WHERE Email = '{email}'") // VULNERABLE!
    .ToListAsync(ct);

Path Traversal Prevention

public static string SanitizeFileName(string fileName)
{
    var sanitized = Path.GetFileName(fileName); // Strips directory components
    var invalid = Path.GetInvalidFileNameChars();
    return new string(sanitized.Where(c => !invalid.Contains(c)).ToArray());
}

// Validate path is within allowed directory
public static bool IsPathSafe(string basePath, string requestedPath)
{
    var fullPath = Path.GetFullPath(Path.Combine(basePath, requestedPath));
    return fullPath.StartsWith(Path.GetFullPath(basePath), StringComparison.OrdinalIgnoreCase);
}

HTML/XSS Prevention

• Use Razor encoding (automatic in ASP.NET Core views)
• For APIs returning HTML, use HtmlEncoder.Default.Encode()
• NEVER return raw user input in responses