270
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1286 Improper Validation of Syntactic Correctness of Input 2136
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 1215 Data Validation Issues 2478
Relevant to the view "Seven Pernicious Kingdoms" (CWE-700)
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Unexpected State
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Strategy = Input Validation
Always validate XML input against a known XML Schema or DTD. It is not possible for an XML
parser to validate all aspects of a document's content because a parser cannot understand
the complete semantics of the data. However, a parser can do a complete and thorough job
of checking the document's structure and therefore guarantee to the code that processes the
document that the content is well-formed.
Demonstrative Examples
Example 1:
The following code loads and parses an XML file.
Example Language: Java (Bad)
// Read DOM
try {
...
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setValidating( false );
CWE Version 4.14
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response
Splitting')
CWE-113: Improper Neutralization of CRLF Sequences
in HTTP Headers ('HTTP Request/Response Splitting')