Input Validation · Prompt Injection Defenses
Allow-list the characters you accept
Verify that the system implements a character set restriction for all inputs. The restriction must use an allow-list approach derived from the languages and use cases the system supports, permitting only characters that are explicitly required.
OWASP AISVS v1.01, requirement 2.1.5
In plain English
Accept only the characters your use case needs. If your users write in English and French, you have no reason to accept control characters, private-use code points or scripts you do not support. Cutting them removes a whole family of hiding places for injected instructions.
What good looks like
- The allowed set is written down and derived from the languages and features you support.
- Characters outside the set are rejected or removed, and the event is logged.
- The rule is an allow-list. Anything not listed is refused by default.
- The list is reviewed when you add a language or a feature such as emoji or code input.
How teams usually do it
- Unicode script and general-category checks in the input layer, for example allowing Latin letters, digits, common punctuation and a chosen set of symbols.
- Separate, tighter allow-lists for structured fields such as names, IDs and dates.
- Running this after normalisation (2.1.1), so the check sees the canonical form.
Suggested evidence
- The allow-list and the reason for each script or category on it.
- Tests showing disallowed characters are blocked and supported languages pass.
- Rejection counts from production, to show the rule is live and not blocking real users.
Common mistakes
- A deny-list of known bad characters, which always misses something.
- Blocking characters your real users need, such as accents, apostrophes in names or non-Latin scripts, until someone switches the check off.
- Applying the rule to typed input only and not to document or tool content.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.