452
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Demonstrative Examples
Example 1:
The following code attempts to validate a given input path by checking it against an allowlist and
then return the canonical path. In this specific case, the path is considered valid if it starts with the
string "/safe_dir/".
Example Language: Java (Bad)
String path = getInputPath();
if (path.startsWith("/safe_dir/"))
{
File f = new File(path);
return f.getCanonicalPath();
}
The problem with the above code is that the validation step occurs before canonicalization occurs.
An attacker could provide an input path of "/safe_dir/../" that would pass the validation step.
However, the canonicalization process sees the double dot as a traversal to the parent directory
and hence when canonicized the path would become just "/".
To avoid this problem, validation should occur after canonicalization takes place. In this case
canonicalization occurs during the initialization of the File object. The code below fixes the issue.
Example Language: Java (Good)
String path = getInputPath();
File f = new File(path);
if (f.getCanonicalPath().startsWith("/safe_dir/"))
{
return f.getCanonicalPath();
}
Observed Examples
Reference Description
CVE-2002-0433 Product allows remote attackers to view restricted files via an HTTP request
containing a "*" (wildcard or asterisk) character.
https://www.cve.org/CVERecord?id=CVE-2002-0433
CVE-2003-0332 Product modifies the first two letters of a filename extension after performing
a security check, which allows remote attackers to bypass authentication via a
filename with a .ats extension instead of a .hts extension.
https://www.cve.org/CVERecord?id=CVE-2003-0332
CVE-2002-0802 Database consumes an extra character when processing a character that
cannot be converted, which could remove an escape character from the query
and make the application subject to SQL injection attacks.
https://www.cve.org/CVERecord?id=CVE-2002-0802
CVE-2000-0191 Overlaps "fakechild/../realchild"
https://www.cve.org/CVERecord?id=CVE-2000-0191
CVE-2004-2363 Product checks URI for "<" and other literal characters, but does it before hex
decoding the URI, so "%3E" and other sequences are allowed.
https://www.cve.org/CVERecord?id=CVE-2004-2363
CWE Version 4.14
CWE-181: Incorrect Behavior Order: Validate Before Filter
CWE-181: Incorrect Behavior Order: Validate Before Filter