89
Strategy = Output Encoding
Use and specify an output encoding that can be handled by the downstream component that
is reading the output. Common encodings include ISO-8859-1, UTF-7, and UTF-8. When an
encoding is not specified, a downstream component may choose a different encoding, either
by assuming a default encoding or automatically inferring which encoding is being used, which
can be erroneous. When the encodings are inconsistent, the downstream component might
treat some character or byte sequences as special, even if they are not special in the original
encoding. Attackers might then be able to exploit this discrepancy and conduct injection attacks;
they even might be able to bypass protection mechanisms that assume the original encoding is
also being used by the downstream component.
Phase: Implementation
Strategy = Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation
before being validated (CWE-180). Make sure that the application does not decode the same
input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by
introducing dangerous inputs after they have been checked.
Observed Examples
Reference Description
CVE-2000-1114 Source code disclosure using trailing dot
https://www.cve.org/CVERecord?id=CVE-2000-1114
CVE-2002-1986 Source code disclosure using trailing dot
https://www.cve.org/CVERecord?id=CVE-2002-1986
CVE-2004-2213 Source code disclosure using trailing dot or trailing encoding space "%20"
https://www.cve.org/CVERecord?id=CVE-2004-2213
CVE-2005-3293 Source code disclosure using trailing dot
https://www.cve.org/CVERecord?id=CVE-2005-3293
CVE-2004-0061 Bypass directory access restrictions using trailing dot in URL
https://www.cve.org/CVERecord?id=CVE-2004-0061
CVE-2000-1133 Bypass directory access restrictions using trailing dot in URL
https://www.cve.org/CVERecord?id=CVE-2000-1133
CVE-2001-1386 Bypass check for ".lnk" extension using ".lnk."
https://www.cve.org/CVERecord?id=CVE-2001-1386
CVE-2001-0693 Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2001-0693
CVE-2001-0778 Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2001-0778
CVE-2001-1248 Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2001-1248
CVE-2004-0280 Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2004-0280
CVE-2005-0622 Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2005-0622
CVE-2005-1656 Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2005-1656
CVE-2002-1603 Source disclosure via trailing encoded space "%20"
https://www.cve.org/CVERecord?id=CVE-2002-1603
CVE-2001-0054 Multi-Factor Vulnerability (MFV). directory traversal and other issues in FTP
server using Web encodings such as "%20"; certain manipulations have
unusual side effects.
https://www.cve.org/CVERecord?id=CVE-2001-0054
CVE-2002-1451 Trailing space ("+" in query string) leads to source code disclosure.
https://www.cve.org/CVERecord?id=CVE-2002-1451
CWE Version 4.14
CWE-41: Improper Resolution of Path Equivalence
CWE-41: Improper Resolution of Path Equivalence