V2.2.1: Verify that input is validated to enforce business or functional expectations for that input. This should either use positive validation against an allow list of values, patterns, and ranges, or be based on comparing the input to an expected structure and logical limits according to predefined rules. For L1, this can focus on input which is used to make specific business or security decisions. For L2 and up, this should apply to all input.
ASVS Maturity
V2.2.2
V2.2.2: Verify that the application is designed to enforce input validation at a trusted service layer. While client-side validation improves usability and should be encouraged, it must not be relied upon as a security control.
ASVS Maturity
V2.2.3
V2.2.3: Verify that the application ensures that combinations of related data items are reasonable according to the pre-defined rules.