# Before: Vulnerable
billing_db_query "SELECT * FROM usage WHERE service='$service'"

# After: Protected
validate_service_name "$service" || return 1
billing_db_query "SELECT * FROM usage WHERE service='$service'"
# Only allows: api, storage, bandwidth, compute, database, functions

# Before: Vulnerable
echo "Welcome to $brand_name"  # $brand_name could contain $(whoami)

# After: Protected
validate_brand_name "$brand_name" || return 1
echo "Welcome to $brand_name"  # Only allows: alphanumeric, space, hyphen, underscore

# Before: Vulnerable
echo "<p>Welcome $user_name</p>"  # user_name could contain <script>alert(1)</script>

# After: Protected
safe_name=$(escape_html_for_email "$user_name")
echo "<p>Welcome $safe_name</p>"  # Properly escaped HTML entities

# Before: Vulnerable
template_file="${TEMPLATES_DIR}/${language}/${template_type}"
# Could be: ../../etc/passwd

# After: Protected
validate_language_code "$language" || return 1
validate_template_type "$template_type" || return 1
template_file="${TEMPLATES_DIR}/${language}/${template_type}"
# Only allows: en, fr, es, zh-CN (valid language codes)

# Before: Vulnerable
validate_file_extension "$logo_path" "png jpg" || return 1
# Could pass: malware.exe renamed to malware.png

# After: Protected
validate_file_extension "$logo_path" "png jpg" || return 1
validate_file_magic_bytes "$logo_path" "image/png" || return 1
# Checks binary magic bytes, not just extension

# Before: Vulnerable
cp "$uploaded_file" "$logo_dir/"  # No size limit

# After: Protected
validate_file_size "$logo_path" 5 || return 1  # Max 5 MB
# Returns error if file exceeds limit

# Before: Vulnerable
metadata='{"user":"admin","admin":"false"}; DROP TABLE users;'
# Could corrupt database via string termination

# After: Protected
validate_metadata "$metadata" || return 1
# Validates JSON structure with jq
safe_metadata=$(sanitize_metadata_json "$metadata")
# Escapes single quotes for SQL safety

# Before: Vulnerable
substitute_template_variables "Hello {{USER_NAME}}" "USER_NAME=$(whoami)"
# Could execute arbitrary commands

# After: Protected
validate_variable_name "USER_NAME" || return 1
validate_variable_value "$(whoami)" || return 1  # Rejects suspicious patterns
escaped=$(html_escape "$(whoami)")
result="Hello ${escaped}"

# Only allow known good values
validate_service_name()      # Whitelist: api, storage, bandwidth, compute, database, functions
validate_logo_type()          # Whitelist: main, icon, email, favicon
validate_template_type()      # Whitelist: 8 template types
validate_period()             # Whitelist: hourly, daily, monthly
validate_format()             # Whitelist: json, csv, table, xlsx

# Validate against strict regex patterns
validate_customer_id()        # Pattern: ^[a-zA-Z0-9_-]+$
validate_brand_name()         # Pattern: ^[a-zA-Z0-9[:space:]_-]+$
validate_tenant_id()          # Pattern: ^[a-zA-Z0-9_-]+$
validate_variable_name()      # Pattern: ^[A-Z][A-Z0-9_]*$
validate_language_code()      # Pattern: ^[a-z]{2}(-[a-zA-Z]{2,4})?$
validate_date_format()        # Pattern: YYYY-MM-DD HH:MM:SS

# Validate data types and ranges
validate_quantity()           # Numeric pattern, non-negative check
validate_alert_threshold()    # Integer 0-100 range
validate_limit()              # Positive integer with max limit

# Validate JSON and file structures
validate_metadata()           # Full JSON validation with jq
validate_file_magic_bytes()   # Binary file type verification
validate_css_security()       # CSS-specific XSS checks
validate_template_content()   # Template code pattern detection

# Escape based on output context
escape_html()                 # HTML entity escaping
escape_html_for_email()       # Email HTML escaping
escape_json_string()          # JSON string escaping
sanitize_url()                # URL protocol validation

# 1. Service lookups
usage_get_service() {
    validate_service_name "$service" || return 1
    # ... safe to use $service in queries
}

# 2. Batch operations
usage_batch_add() {
    validate_customer_id "$customer_id" || return 1
    validate_service_name "$service" || return 1
    validate_quantity "$quantity" || return 1
    validate_metadata "$metadata" || return 1
    # ... all inputs validated
}

# 3. Aggregations
usage_aggregate() {
    validate_period "$period" || return 1
    # ... safe to use in DATE_TRUNC()
}

# 4. Peak analysis
usage_get_peaks() {
    validate_service_name "$service" || return 1
    validate_period "$period" || return 1
    validate_limit "$limit" || return 1
    # ... all inputs safe
}

# 1. Brand creation
create_brand() {
    validate_brand_name "$brand_name" || return 1
    validate_tenant_id "$tenant_id" || return 1
    # ... safe to use in JSON config
}

# 2. Logo uploads
upload_brand_logo() {
    validate_logo_type "$logo_type" || return 1
    validate_file_extension "$logo_path" "$SUPPORTED_LOGO_FORMATS" || return 1
    validate_file_size "$logo_path" "$MAX_LOGO_SIZE_MB" || return 1
    validate_file_magic_bytes "$logo_path" "$expected_mime" || return 1
    # ... file is safe to process
}

# 3. CSS uploads
set_custom_css() {
    validate_file_extension "$css_path" "css" || return 1
    validate_file_size "$css_path" "$MAX_CSS_SIZE_MB" || return 1
    validate_css_security "$css_path" || return 1
    # ... CSS is safe to use
}

# 1. Template rendering
render_template() {
    validate_template_type "$template_type" || return 1
    validate_language_code "$language" || return 1
    validate_template_content "$template_file" || return 1
    # ... safe to load and process
}

# 2. Variable substitution
substitute_template_variables() {
    for var in "${variables[@]}"; do
        validate_variable_name "$var_name" || continue
        validate_variable_value "$var_value" || return 1
        escaped=$(escape_html_for_email "$var_value")
        # ... safe to substitute
    done
}

# 3. URL validation
# In templates:
safe_url=$(sanitize_url "$action_url") || return 1
# Prevents javascript: and data: protocol attacks

bash -n src/lib/billing/usage.sh        # ✅ PASS
bash -n src/lib/whitelabel/branding.sh  # ✅ PASS
bash -n src/lib/whitelabel/email-templates.sh  # ✅ PASS

# Monitor validation rejections
grep -r "Invalid\|Error:" /var/log/nself/ | wc -l

# Analyze attack patterns
grep "'; DROP\|javascript:\|eval\|exec" /var/log/nself/

# Alert on suspicious activity
watch 'grep "Invalid" /var/log/nself/*.log | tail -20'

# Update USAGE_SERVICES
declare -a USAGE_SERVICES=(
    "api" "storage" "bandwidth" "compute" "database" "functions"
    "new-service"  # Add here
)

# Update TEMPLATE_TYPES
readonly TEMPLATE_TYPES="... new-type"