1081
Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
Phase: Architecture and Design
Strategy = Output Encoding
Create a strategy for presenting information, and plan for how to display unusual characters.
Observed Examples
Reference Description
CVE-2004-2227 Web browser's filename selection dialog only shows the beginning portion
of long filenames, which can trick users into launching executables with
dangerous extensions.
https://www.cve.org/CVERecord?id=CVE-2004-2227
CVE-2001-0398 Attachment with many spaces in filename bypasses "dangerous content"
warning and uses different icon. Likely resultant.
https://www.cve.org/CVERecord?id=CVE-2001-0398
CVE-2001-0643 Misrepresentation and equivalence issue.
https://www.cve.org/CVERecord?id=CVE-2001-0643
CVE-2005-0593 Lock spoofing from several different weaknesses.
https://www.cve.org/CVERecord?id=CVE-2005-0593
CVE-2004-1104 Incorrect indicator: web browser can be tricked into presenting the wrong URL
https://www.cve.org/CVERecord?id=CVE-2004-1104
CVE-2005-0143 Incorrect indicator: Lock icon displayed when an insecure page loads a binary
file loaded from a trusted site.
https://www.cve.org/CVERecord?id=CVE-2005-0143
CVE-2005-0144 Incorrect indicator: Secure "lock" icon is presented for one channel, while an
insecure page is being simultaneously loaded in another channel.
https://www.cve.org/CVERecord?id=CVE-2005-0144
CVE-2004-0761 Incorrect indicator: Certain redirect sequences cause security lock icon to
appear in web browser, even when page is not encrypted.
https://www.cve.org/CVERecord?id=CVE-2004-0761
CVE-2004-2219 Incorrect indicator: Spoofing via multi-step attack that causes incorrect
information to be displayed in browser address bar.
https://www.cve.org/CVERecord?id=CVE-2004-2219
CVE-2004-0537 Overlay: Wide "favorites" icon can overlay and obscure address bar
https://www.cve.org/CVERecord?id=CVE-2004-0537
CVE-2005-2271 Visual distinction: Web browsers do not clearly associate a Javascript dialog
box with the web page that generated it, allowing spoof of the source of the
dialog. "origin validation error" of a sort?
https://www.cve.org/CVERecord?id=CVE-2005-2271
CVE-2005-2272 Visual distinction: Web browsers do not clearly associate a Javascript dialog
box with the web page that generated it, allowing spoof of the source of the
dialog. "origin validation error" of a sort?
https://www.cve.org/CVERecord?id=CVE-2005-2272
CVE-2005-2273 Visual distinction: Web browsers do not clearly associate a Javascript dialog
box with the web page that generated it, allowing spoof of the source of the
dialog. "origin validation error" of a sort?
https://www.cve.org/CVERecord?id=CVE-2005-2273
CVE-2005-2274 Visual distinction: Web browsers do not clearly associate a Javascript dialog
box with the web page that generated it, allowing spoof of the source of the
dialog. "origin validation error" of a sort?
https://www.cve.org/CVERecord?id=CVE-2005-2274
CVE-2001-1410 Visual distinction: Browser allows attackers to create chromeless windows and
spoof victim's display using unprotected Javascript method.
https://www.cve.org/CVERecord?id=CVE-2001-1410
CWE Version 4.14
CWE-451: User Interface (UI) Misrepresentation of Critical Information
CWE-451: User Interface (UI) Misrepresentation of Critical Information