Skip to content
ENExplore Calculators

Input Validation Coverage Calculator

Measure weighted input validation coverage across your parameters and estimate the injection findings still waiting in the gaps.

About Input Validation Coverage Calculator

Allow-list validation carries the most weight because it is the only control that rejects the unexpected rather than trying to enumerate the dangerous, and canonicalisation is weighted alongside it because a check performed before decoding can be bypassed. Client-side-only validation is scaled to 40% since it is a usability feature, not a control. Coverage is the number that predicts your next injection finding: the parameters nobody validated are the parameters the next test will break, and this turns that into a count you can plan against.

Formulas

Input Validation Coverage

coverage = 0.35 × allow-list coverage + 0.25 × schema coverage + 0.15 × bounds coverage + 0.15 × canonicalisation coverage + 0.10 × fuzz coverage, each expressed as a percentage of parameters in scope.

allow-list coverage
Share of parameters checked against a positive pattern
canonicalisation coverage
Share decoded and normalised before checking

Expected findings

expected findings = unvalidated parameters × findings per 100 unvalidated parameters ÷ 100; client-only validation scales the whole score to 40%.

unvalidated parameters
Parameters with no allow-list validation
findings per 100
Your historical yield from testing

Worked example

With the default values below, Input Validation Coverage Calculator returns Weighted Validation Coverage of 53.0%. Change any input above and every figure here is recalculated in your browser.

Inputs used

Input parameters in scopeaccepts 1–100,000 parameters
480 parameters
Parameters with allow-list validationaccepts 0–100,000 parameters
210 parameters
Parameters with type or schema validationaccepts 0–100,000 parameters
400 parameters
Parameters with length or range boundsaccepts 0–100,000 parameters
330 parameters
Parameters canonicalised before validationaccepts 0–100,000 parameters
150 parameters
Parameters covered by fuzz or property testsaccepts 0–100,000 parameters
90 parameters
Validation enforced server-side, not only in the client
Yes
Injection findings per 100 unvalidated parametersaccepts 0–100 findings
12 findings

Results

Weighted Validation Coverage
53.0%
Coverage Grade
D — Weak
Parameters Without Allow-List Validation
270
Expected Injection Findings
32.4
Weakest Validation Control
Fuzz or property test coverage
Residual Exposure
47.0%

Step by step

  1. 1Values used
  2. 2Input Validation Coverage
  3. 3Expected findings
  4. 4Weighted Validation Coverage= 53.0
  5. 5Coverage Grade= D — Weak
  6. 6Parameters Without Allow-List Validation= 270
  7. 7Expected Injection Findings= 32.4
  8. 8Weakest Validation Control= Fuzz or property test coverage
  9. 9Residual Exposure= 47.0

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

Frequently Asked Questions

How is Input Validation Coverage calculated?

coverage = 0.35 × allow-list coverage + 0.25 × schema coverage + 0.15 × bounds coverage + 0.15 × canonicalisation coverage + 0.10 × fuzz coverage, each expressed as a percentage of parameters in scope. Allow-list validation carries the most weight because it is the only control that rejects the unexpected rather than trying to enumerate the dangerous, and canonicalisation is weighted alongside it because a check performed before decoding can be bypassed. Client-side-only validation is scaled to 40% since it is a usability feature, not a control.

Why does Input Validation Coverage matter?

Coverage is the number that predicts your next injection finding: the parameters nobody validated are the parameters the next test will break, and this turns that into a count you can plan against.

What values do I need to enter?

This calculator takes 8 inputs: Input parameters in scope, Parameters with allow-list validation, Parameters with type or schema validation, Parameters with length or range bounds, Parameters canonicalised before validation, Parameters covered by fuzz or property tests, Validation enforced server-side, not only in the client, Injection findings per 100 unvalidated parameters. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.

Is schema validation the same as allow-list validation?

No, and the gap is where bugs live. A schema proves a field is a string of at most 64 characters; an allow-list proves it matches the format that field is actually allowed to take. JSON Schema plus a per-field pattern gets you both, and the pattern is the part that stops injection.

Related Calculators

Input Validation Coverage Calculator | Calcrivo