Protection against malicious code (input validation, dependency integrity)

CMMC 2.0 SI.L1-3.14.2 (NIST 800-171r2 3.14.2) requires protection against malicious code at appropriate locations in organizational systems. The primary code-level attack vectors are SQL injection via string-concatenated queries, XSS via raw innerHTML insertion of user content, and dependency confusion via uncontrolled registry sources. A single SQL injection point in a route that handles FCI gives an attacker arbitrary read/write access to the database. CWE-20 (Improper Input Validation), CWE-89 (SQL Injection), and OWASP A03 (Injection) all apply. Zod-validated API routes using ORM queries eliminate both injection classes simultaneously.

Validate every API input with Zod before it touches the database or the DOM. Use Prisma or parameterized queries — never string-concatenate user input into SQL:

// lib/validation/search.ts
import { z } from 'zod'
export const searchSchema = z.object({
  query: z.string().min(1).max(200).trim(),
  category: z.enum(['documents', 'users', 'contracts']).optional(),
})

// app/api/search/route.ts
export async function POST(req: Request) {
  const result = searchSchema.safeParse(await req.json())
  if (!result.success) return Response.json({ error: 'Invalid search parameters' }, { status: 400 })

  const { query, category } = result.data
  // Prisma parameterizes automatically — no injection possible
  const docs = await prisma.document.findMany({
    where: { title: { contains: query, mode: 'insensitive' }, ...(category ? { category } : {}) },
  })
  return Response.json(docs)
}

For React components, prefer {userContent} interpolation — React escapes HTML automatically. When HTML rendering is unavoidable, install dompurify and sanitize before insertion. Never use dangerouslySetInnerHTML={{ __html: userContent }} without prior sanitization.