704
is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for
malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if
the code's environment changes. This can give attackers enough room to bypass the intended
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2003-0317 Protection mechanism that restricts URL access can be bypassed using URL
encoding.
https://www.cve.org/CVERecord?id=CVE-2003-0317
CVE-2004-0847 Bypass of authentication for files using "\" (backslash) or "%5C" (encoded
backslash).
https://www.cve.org/CVERecord?id=CVE-2004-0847
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 845 The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 2 - Input Validation and Data
Sanitization (IDS)
844 2362
MemberOf 947 SFP Secondary Cluster: Authentication Bypass 888 2394
MemberOf 1134 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 00. Input Validation and Data Sanitization
(IDS)
1133 2444
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Notes
Relationship
Overlaps equivalent encodings, canonicalization, authorization, multiple trailing slash, trailing
space, mixed case, and other equivalence issues.
Theoretical
Alternate names are useful in data driven manipulation attacks, not just for authentication.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Authentication bypass by alternate
name
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS01-J CWE More Specific Normalize strings before validating
them
SEI CERT Oracle Coding
Standard for Java
IDS01-J CWE More Specific Normalize strings before validating
them
CWE Version 4.14
CWE-290: Authentication Bypass by Spoofing
CWE-290: Authentication Bypass by Spoofing