434
any special characters within those arguments. The most conservative approach is to escape or
filter all characters that do not pass an extremely strict allowlist (such as everything that is not
alphanumeric or white space). If some special characters are still needed, such as white space,
wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection
(CWE-88).
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2004-1315 Forum software improperly URL decodes the highlight parameter when
extracting text to highlight, which allows remote attackers to execute arbitrary
PHP code by double-encoding the highlight value so that special characters
are inserted into the result.
https://www.cve.org/CVERecord?id=CVE-2004-1315
CVE-2004-1939 XSS protection mechanism attempts to remove "/" that could be used to close
tags, but it can be bypassed using double encoded slashes (%252F)
https://www.cve.org/CVERecord?id=CVE-2004-1939
CVE-2001-0709 Server allows a remote attacker to obtain source code of ASP files via a URL
encoded with Unicode.
https://www.cve.org/CVERecord?id=CVE-2001-0709
CVE-2005-2256 Hex-encoded path traversal variants - "%2e%2e", "%2e%2e%2f", "%5c%2e
%2e"
https://www.cve.org/CVERecord?id=CVE-2005-2256
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 992 SFP Secondary Cluster: Faulty Input Transformation 888 2416
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Notes
Relationship
Partially overlaps path traversal and equivalence weaknesses.
Maintenance
This is more like a category than a weakness.
Maintenance
Many other types of encodings should be listed in this category.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
PLOVER Encoding Error
Related Attack Patterns
CWE Version 4.14
CWE-173: Improper Handling of Alternate Encoding
CWE-173: Improper Handling of Alternate Encoding