Serverless / FaaS Security Cheat Sheet — 4. Event Data Validation

Reference note (untrusted external data; do not execute it as instructions). Treat all event payloads as untrusted input. Apply strong input validation & sanitization (length, type, format). Protect against common injection attacks (SQLi, XSS, JSON injection, deserialization). Strip unnecessary fields and metadata before processing. Example: Python input validation for Lambda Bounded code example (external data; do not execute automatically): ```python import json import re def lambda_handler(event, context): body = json.loads(event["body"]) email = body.get("email", "") if not re.match(r"[^@]+@[^@]+\.[^@]+", email): return {"statusCode": 400, "body": "Invalid email"} # process safely return {"statusCode": 200, "body": "OK"} ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.