438
validation. However, denylists can be useful for detecting potential attacks or determining which
inputs are so malformed that they should be rejected outright.
Phase: Implementation
Strategy = Output Encoding
Use and specify an output encoding that can be handled by the downstream component that
is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an
encoding is not specified, a downstream component may choose a different encoding, either
by assuming a default encoding or automatically inferring which encoding is being used, which
can be erroneous. When the encodings are inconsistent, the downstream component might
treat some character or byte sequences as special, even if they are not special in the original
encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks;
they even might be able to bypass protection mechanisms that assume the original encoding is
also being used by the downstream component.
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2004-1315 Forum software improperly URL decodes the highlight parameter when
extracting text to highlight, which allows remote attackers to execute arbitrary
PHP code by double-encoding the highlight value so that special characters
are inserted into the result.
https://www.cve.org/CVERecord?id=CVE-2004-1315
CVE-2004-1939 XSS protection mechanism attempts to remove "/" that could be used to close
tags, but it can be bypassed using double encoded slashes (%252F)
https://www.cve.org/CVERecord?id=CVE-2004-1939
CVE-2001-0333 Directory traversal using double encoding.
https://www.cve.org/CVERecord?id=CVE-2001-0333
CVE-2004-1938 "%2527" (double-encoded single quote) used in SQL injection.
https://www.cve.org/CVERecord?id=CVE-2004-1938
CVE-2005-1945 Double hex-encoded data.
https://www.cve.org/CVERecord?id=CVE-2005-1945
CVE-2005-0054 Browser executes HTML at higher privileges via URL with hostnames that
are double hex encoded, which are decoded twice to generate a malicious
hostname.
https://www.cve.org/CVERecord?id=CVE-2005-0054
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 992 SFP Secondary Cluster: Faulty Input Transformation 888 2416
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Notes
Research Gap
CWE Version 4.14
CWE-175: Improper Handling of Mixed Encoding
CWE-175: Improper Handling of Mixed Encoding