Audit SQL Injection, XSS, and Mixed Content Boundaries

SQL injection, cross-site scripting, and mixed content all start at a boundary, but they are not the same bug. This pack keeps the three audits separate so each reel CTA gets a complete testable module.

This guide belongs to reel R082. Comment SQLI or XSS or MIXED for the matching module and runnable starter.

Define the boundary before building

Input: query construction code, user-controlled fields, HTML rendering paths, sanitizer policy, deployed page URLs, content security policy, and asset inventory.

Output: three separate security modules, unsafe boundary findings, exact evidence, remediation drafts, security tests, and owner approval state.

The starter keeps exact checks in code and gives Claude only the reviewable drafting work. Dry-run is the default. Live mode can call Anthropic's Messages API, but it still returns a draft and performs no external action.

Paste this boundary into Claude Code before asking for implementation:

Workflow: Audit SQL Injection, XSS, and Mixed Content Boundaries
Input: query construction code, user-controlled fields, HTML rendering paths, sanitizer policy, deployed page URLs, content security policy, and asset inventory
Output: three separate security modules, unsafe boundary findings, exact evidence, remediation drafts, security tests, and owner approval state

Map the trigger, strict input fields, deterministic code checks, Claude drafting step, approval gate, failure queue, and saved evidence. Use null for missing facts. Do not change code or call an external service yet.

The modules that matter

R082 SQL injection boundary

Search for string interpolation, concatenation, raw query helpers, and user-controlled sort or column names. Bind values through parameters. For identifiers that cannot be parameterized, map a small allowlist to known SQL fragments. Test with the application database role, not an all-powerful local account.

R083 XSS output boundary

Use the framework default that renders text as text. Inventory every escape hatch such as innerHTML, dangerouslySetInnerHTML, template raw blocks, Markdown HTML, and rich-text rendering. Sanitize only where HTML is a real product requirement, then test stored and reflected payloads.

R101 mixed-content boundary

Load the deployed HTTPS page and inventory scripts, styles, fonts, images, video, WebSockets, iframes, redirects, and dynamically created URLs. Remove every HTTP dependency. Use Content-Security-Policy reporting as evidence, not as permission to ignore a broken asset.

Rules worth keeping beside the code

Keep SQL injection, browser script execution, and mixed content as separate review modules.
Use parameterized values and allowlist identifiers in database queries.
Render untrusted text as text and sanitize only at reviewed HTML boundaries.
Load every production subresource through HTTPS and verify the deployed page.

The dangerous version is combining distinct vulnerabilities into vague advice, executing attack payloads against production, trusting AI as a scanner, or auto-applying security changes. The pack deliberately stops at a draft so a person can inspect those boundaries before enabling anything real.

Test the ugly paths

Quote and boolean SQL payloads remain plain values.
Unapproved sort identifiers are rejected.
Stored user content renders without executing.
Reflected query text remains escaped.
Every deployed subresource resolves through HTTPS.
A security owner reviews each dismissal.

The final verification is concrete: Run the supplied SQL, stored and reflected XSS, and HTTPS asset tests in an approved test environment and have a security owner review each result.

Use this prompt to turn the evidence into acceptance tests:

Design tests for Audit SQL Injection, XSS, and Mixed Content Boundaries using only the attached fictional fixtures.
Cover the normal path, missing input, malformed input, a repeated event, a permission failure, a dependency failure, and the named safety boundary.
For each test return: input, expected state, prohibited side effect, and evidence to save.
Do not execute external actions.

Run the pack locally

The ZIP is a complete Node 22 starter with no third-party npm dependency. It includes an importable n8n webhook, Docker Compose, GitHub Actions validation and manual-run workflows, deterministic samples, and tests.

npm test
npm run validate
npm run sample
cp .env.example .env
docker compose up --build

Only set WORKFLOW_MODE=live, ANTHROPIC_API_KEY, and ANTHROPIC_MODEL after the dry-run output and tests make sense for your system. Keep real secrets in the environment, never in the n8n export.

Download the runnable pack

Start with the fictional dry-run. It validates the input and returns a reviewable draft without changing code, production data, customer accounts, or an external service.

Before enabling a real action

Replace every fictional fixture, assign the approval owner, define the duplicate key, set a timeout and retry rule, and save the original evidence. Then test one failure on purpose. If the workflow cannot stop visibly and replay safely, it is not ready to act.