21
Implied or derived properties of data must often be calculated or inferred by the code itself. Errors
in deriving properties may be considered a contributing factor to improper input validation.
Note that "input validation" has very different meanings to different people, or within different
classification schemes. Caution must be used when referencing this CWE entry or mapping to it.
For example, some weaknesses might involve inadvertently giving control to an attacker over an
input when they should not be able to provide an input at all, but sometimes this is referred to as
input validation.
Finally, it is important to emphasize that the distinctions between input validation and output
escaping are often blurred, and developers must be careful to understand the difference, including
how input validation is not always sufficient to prevent vulnerabilities, especially when less stringent
data types must be supported, such as free-form text. Consider a SQL injection scenario in which
a person's last name is inserted into a query. The name "O'Reilly" would likely pass the validation
step since it is a common last name in the English language. However, this valid name cannot be
directly inserted into the database because it contains the "'" apostrophe character, which would
need to be escaped or otherwise transformed. In this case, removing the apostrophe might reduce
the risk of SQL injection, but it would produce incorrect behavior because the wrong name would
be recorded.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 707 Improper Neutralization 1546
ParentOf 179 Incorrect Behavior Order: Early Validation 448
ParentOf 622 Improper Validation of Function Hook Arguments 1387
ParentOf 1173 Improper Use of Validation Framework 1969
ParentOf 1284 Improper Validation of Specified Quantity in Input 2130
ParentOf 1285 Improper Validation of Specified Index, Position, or Offset in
Input