Validate untrusted input before parser construction

#Metadata

Rule ID

ts.security.unvalidated-external-input

Severity

medium

Confidence

0.8

Languages

javascript, typescript

Presets

security, strict

Stability

stable

Applies to

block

Tags

crq-sec-027, input-validation, rules-catalog, security

#Why it matters

Passing untrusted text across regex or URL construction boundaries increases the risk of parser abuse, denial of service, and downstream policy bypass.

#Remediation

Validate, sanitize, or normalize the untrusted value before passing it into URL, RegExp, or similarly sensitive constructors.

#Repository path

The generated metadata points to critiq-rules/libs/rules/catalog/rules/typescript/ts.security.unvalidated-external-input.rule.yaml.