Enforce Input Validation and Sanitization
Info
ID: MS-M7016
MITRE mitigation: M1013
Validate and sanitize all inputs before processing, including event payloads, file metadata, API parameters, and user-supplied data. Use strict schemas and allowlists to ensure inputs conform to expected formats.
Techniques Addressed by Mitigation
| ID | Name | Use |
|---|---|---|
| MS-TA7006 | Serverless trigger injection | Validate all event inputs (message payloads, file metadata, API parameters) against strict schemas before processing. |
| MS-TA7024 | Server side request forgery (SSRF) | Normalize URLs, strip credentials, and validate against known-safe patterns before making requests. |