|
|
|
|
CWE-138 Individual Dictionary Definition (Draft 9)
Weakness ID
| Status: Draft 138 (Weakness Class) | | Description | Summary The software fails to prevent the introduction of special elements with control implications into a mixed data / control stream. Extended Description Often times, platforms or environments have special elements that carry control implications. If software fails to prevent external control or influence over the inclusion of such special elements, the control flow of the program may be altered from what was intended. | | Potential Mitigations | Developers should anticipate that special elements (e.g. delimiters, symbols) will be
injected into input vectors of their software system. One defense is to create a while list
(e.g. a regular expression) that defines valid input according to the requirements
specifications. Strictly filter any input that does not match against the white
list. | | Relationships | | | Source Taxonomies | PLOVER - Special Elements (Characters or Reserved Words) | | Related Attack Patterns | | CAPEC-ID | Attack Pattern Name |
|---|
| 15 | Command Delimiters |
|
|
- Weakness
- Base
- Variant
- Class
- Chain
- Composite
- Category
- View
- Deprecated
