163
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Common Consequences
Scope Impact Likelihood
Integrity Unexpected State
Potential Mitigations
Phase: Implementation
Strategy = Input Validation
Resolve all URIs to absolute or canonical representations before processing.
Phase: Implementation
Strategy = Input Validation
Carefully check each input parameter against a rigorous positive specification (allowlist) defining
the specific characters and format allowed. All input should be neutralized, not just parameters
that the user is supposed to specify, but all data in the request, including tag attributes, hidden
fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing
XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site.
We often encounter data from the request that is reflected by the application server or the
application that the development team did not anticipate. Also, a field that is not currently
reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP
request is recommended.
Phase: Implementation
CWE Version 4.14
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page