457
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Canonicalize the name to match that of the file system's representation of the name. This can
sometimes be achieved with an available API (e.g. in Win32 the GetFullPathName function).
Observed Examples
Reference Description
CVE-2004-0815 "/.////" in pathname collapses to absolute path.
https://www.cve.org/CVERecord?id=CVE-2004-0815
CVE-2005-3123 "/.//..//////././" is collapsed into "/.././" after ".." and "//" sequences are removed.
https://www.cve.org/CVERecord?id=CVE-2005-3123
CVE-2002-0325 ".../...//" collapsed to "..." due to removal of "./" in web server.
https://www.cve.org/CVERecord?id=CVE-2002-0325
CVE-2002-0784 chain: HTTP server protects against ".." but allows "." variants such as
"////./../.../". If the server removes "/.." sequences, the result would collapse into
an unsafe value "////../" (CWE-182).
https://www.cve.org/CVERecord?id=CVE-2002-0784
CVE-2005-2169 MFV. Regular expression intended to protect against directory traversal
reduces ".../...//" to "../".
https://www.cve.org/CVERecord?id=CVE-2005-2169
CVE-2001-1157 XSS protection mechanism strips a <script> sequence that is nested in another
<script> sequence.
https://www.cve.org/CVERecord?id=CVE-2001-1157
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 722 OWASP Top Ten 2004 Category A1 - Unvalidated Input 711 2334
MemberOf 845 The CERT Oracle Secure Coding Standard for
Java (2011) Chapter 2 - Input Validation and Data
Sanitization (IDS)
844 2362
MemberOf 992 SFP Secondary Cluster: Faulty Input Transformation 888 2416
MemberOf 1134 SEI CERT Oracle Secure Coding Standard for Java -
Guidelines 00. Input Validation and Data Sanitization
(IDS)
1133 2444
MemberOf 1413 Comprehensive Categorization: Protection Mechanism
Failure
1400 2542
Notes
Relationship
Overlaps regular expressions, although an implementation might not necessarily use regexp's.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Collapse of Data into Unsafe Value
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS11-J Eliminate noncharacter code points
before validation
References
CWE Version 4.14
CWE-183: Permissive List of Allowed Inputs
CWE-183: Permissive List of Allowed Inputs