T09 · Insecure Skill Coding Practices
Warning
- Location
src/multiplayer-engine.js:141- Finding
Malformed Object Input Causes Unhandled Exception in Multiplayer Command Validation
- Content
View full analysis
- Remediation
View remediation
normalizedInput === cmd.toLowerCase() || normalizedInput.startsWith(cmd.toLowerCase()) ); } ``` 3. Normalize once and pass only the normalized command to both validation and execution. This prevents inconsistent interpretation between security checks and command handling. 4. Remove caller-controlled identity substitution: ```javascript return this.multiplayerGame.processChoice(playerId, normalized.choice); ``` Do not use `input.playerId` for authorization or game actions. The trusted integration layer must supply the authenticated player identifier separately. 5. Add a public exception boundary so malformed input produces a controlled error instead of propagating: ```javascript processInput(input, playerId) { try { return games.safeHandleInput(input, playerId); } catch (error) { return { error: 'invalid_input', message: 'The supplied command is invalid.' }; } } ``` 6. Add automated tests covering: - String input. - Valid object input. ...[truncated 297 chars]