ruby 9 lines · 1 tab

Input validation with allowlists and explicit schemas

Kai Nakamura Apr 2026

1 tab

RegistrationSchema = Dry::Schema.Params do
  required(:email).filled(:string, format?: URI::MailTo::EMAIL_REGEXP)
  required(:password).filled(:string, min_size?: 12)
  optional(:marketing_opt_in).filled(:bool)
  optional(:country).filled(:string, included_in?: %w[US CA GB AU])
end

result = RegistrationSchema.call(params.to_unsafe_h)
raise ActionController::BadRequest, result.errors.to_h unless result.success?

1 file · ruby Explain with highlit

I validate input at trust boundaries, not halfway through business logic. Explicit schemas force decisions about allowed types, lengths, enums, and nested structure. That keeps weird payloads from becoming security bugs and makes error behavior much easier to reason about.

Related snips

ruby

# Vulnerable: user input is concatenated directly into SQL.
email = params[:email]
password = params[:password]

sql = "SELECT * FROM users WHERE email = '#{email}' AND password_hash = '#{password}'"
user = ActiveRecord::Base.connection.execute(sql).first

SQL injection prevention with unsafe and safe query patterns

sql-injection owasp database

by Kai Nakamura 3 tabs

ruby

raw_token = SecureRandom.urlsafe_base64(32)
token_digest = Digest::SHA256.hexdigest(raw_token)

PasswordReset.create!(
  user: user,
  token_digest: token_digest,

Secure random token generation for sessions and recovery flows

randomness tokens authentication

by Kai Nakamura 1 tab

python

import psycopg

with psycopg.connect(conninfo) as connection:
    with connection.cursor() as cursor:
        cursor.execute(
            'SELECT id, email FROM users WHERE email = %s',

Parameterized queries in Python with psycopg

python sql-injection psycopg

by Kai Nakamura 1 tab

ruby

cookies.encrypted[:trusted_device] = {
  value: { user_id: current_user.id, fingerprint: device_fingerprint }.to_json,
  expires: 30.days.from_now,
  httponly: true,
  secure: Rails.env.production?,
  same_site: :strict,

Signed and encrypted Rails cookies for tamper resistant state

rails cookies encryption

by Kai Nakamura 1 tab

python

from defusedxml.ElementTree import fromstring

payload = request.data.decode('utf-8')
root = fromstring(payload)
invoice_number = root.findtext('invoice_number')

XXE safe XML parsing with external entity resolution disabled

xxe xml parsing

by Kai Nakamura 1 tab

ruby

base_path = Rails.root.join('storage', 'exports').realpath
requested = base_path.join(params[:filename].to_s).cleanpath

unless requested.to_s.start_with?(base_path.to_s) && requested.file?
  raise ActionController::RoutingError, 'Not Found'
end

Preventing path traversal in download endpoints

path-traversal file-security secure-coding

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Input validation with allowlists and explicit schemas — share card

Link copied