2141
Notes
Maintenance
This entry is still under development and will continue to see updates and content improvements.
CWE-1289: Improper Validation of Unsafe Equivalence in Input
Weakness ID : 1289
Structure : Simple
Abstraction : Base
Description
The product receives an input value that is used as a resource identifier or other type of reference,
but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe
value.
Extended Description
Attackers can sometimes bypass input validation schemes by finding inputs that appear to be
safe, but will be dangerous when processed at a lower layer or by a downstream component. For
example, a simple XSS protection mechanism might try to validate that an input has no "<script>"
tags using case-sensitive matching, but since HTML is case-insensitive when processed by web
browsers, an attacker could inject "<ScrIpT>" and trigger XSS.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
PeerOf 41 Improper Resolution of Path Equivalence 86
PeerOf 178 Improper Handling of Case Sensitivity 445
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1215 Data Validation Issues 2478
Applicable Platforms
Language : Not Language-Specific (Prevalence = Often)
Common Consequences
Scope Impact Likelihood
Other Varies by Context
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use
a list of acceptable inputs that strictly conform to specifications. Reject any input that does not
strictly conform to specifications, or transform it into something that does. When performing
input validation, consider all potentially relevant properties, including length, type of input, the
CWE Version 4.14
CWE-1290: Incorrect Decoding of Security Identifiers
CWE-1290: Incorrect Decoding of Security Identifiers