467
Nature Type ID Name Page
MemberOf 19 Data Processing Errors 2309
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Potential Mitigations
Phase: Implementation
Regular expressions can become error prone when defining a complex language even for those
experienced in writing grammars. Determine if several smaller regular expressions simplify one
large regular expression. Also, subject your regular expression to thorough testing techniques
such as equivalence partitioning, boundary value analysis, and robustness. After testing and a
reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit
is allowed to slip through, then record the exploit and refactor your regular expression.
Observed Examples
Reference Description
CVE-2005-1604 MIE. ".php.ns" bypasses ".php$" regexp but is still parsed as PHP by Apache.
(manipulates an equivalence property under Apache)
https://www.cve.org/CVERecord?id=CVE-2005-1604
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 990 SFP Secondary Cluster: Tainted Input to Command 888 2413
MemberOf 1397 Comprehensive Categorization: Comparison 1400 2523
Notes
Relationship
Can overlap allowlist/denylist errors (CWE-183/CWE-184)
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Overly Restrictive Regular Expression
CWE-187: Partial String Comparison
Weakness ID : 187
Structure : Simple
Abstraction : Variant
Description
The product performs a comparison that only examines a portion of a factor before determining
whether there is a match, such as a substring, leading to resultant weaknesses.
Extended Description
CWE Version 4.14
CWE-187: Partial String Comparison
CWE-187: Partial String Comparison