287
Nature Type ID Name Page
MemberOf 1407 Comprehensive Categorization: Improper Neutralization 1400 2532
Notes
Relationship
This weakness is primary to all weaknesses related to injection (CWE-74) since the inherent
nature of injection involves the violation of structured messages.
Relationship
CWE-116 and CWE-20 have a close association because, depending on the nature of the
structured message, proper input validation can indirectly prevent special characters from
changing the meaning of a structured message. For example, by validating that a numeric
ID field should only contain the 0-9 characters, the programmer effectively prevents injection
attacks. However, input validation is not always sufficient, especially when less stringent data
types must be supported, such as free-form text. Consider a SQL injection scenario in which a
last name is inserted into a query. The name "O'Reilly" would likely pass the validation step since
it is a common last name in the English language. However, it cannot be directly inserted into
the database because it contains the "'" apostrophe character, which would need to be escaped
or otherwise neutralized. In this case, stripping the apostrophe might reduce the risk of SQL
injection, but it would produce incorrect behavior because the wrong name would be recorded.
Terminology
The usage of the "encoding" and "escaping" terms varies widely. For example, in some
programming languages, the terms are used interchangeably, while other languages provide
APIs that use both terms for different tasks. This overlapping usage extends to the Web, such
as the "escape" JavaScript function whose purpose is stated to be encoding. The concepts of
encoding and escaping predate the Web by decades. Given such a context, it is difficult for CWE
to adopt a consistent vocabulary that will not be misinterpreted by some constituency.
Theoretical
This is a data/directive boundary error in which data boundaries are not sufficiently enforced
before it is sent to a different control sphere.
Research Gap
While many published vulnerabilities are related to insufficient output encoding, there is such
an emphasis on input validation as a protection mechanism that the underlying causes are
rarely described. Within CVE, the focus is primarily on well-understood issues like cross-site
scripting and SQL injection. It is likely that this weakness frequently occurs in custom protocols
that support multiple encodings, which are not necessarily detectable with automated techniques.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
WASC 22 Improper Output Handling
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS00-J Exact Sanitize untrusted data passed across
a trust boundary
The CERT Oracle Secure
Coding Standard for Java
(2011)
IDS05-J Use a subset of ASCII for file and path
names
SEI CERT Oracle Coding
Standard for Java
IDS00-J Imprecise Prevent SQL injection
SEI CERT Perl Coding
Standard
IDS33-
PL
Exact Sanitize untrusted data passed across
a trust boundary
Related Attack Patterns
CWE Version 4.14
CWE-117: Improper Output Neutralization for Logs
CWE-117: Improper Output Neutralization for Logs