CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Incorrect Behavior Order: Validate Before Canonicalize
Weakness ID: 180 (Weakness Base)
Status: Draft
Description
Description Summary
The software validates input before it is canonicalized, which prevents the software from detecting data that becomes invalid after the canonicalization step.
Extended Description
This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.
Time of Introduction
Implementation
Applicable Platforms
Languages
All
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism
Demonstrative Examples
Example 1
The following code attempts to validate a given input path by
checking it against a whitelist and then return the canonical path. In this
specific case, the path is considered valid if it starts with the string
"/safe_dir/".
(Bad Code)
Example
Language: Java
String path = getInputPath();
if (path.startsWith("/safe_dir/"))
{
File f = new File(path);
return f.getCanonicalPath();
}
The problem with the above code is that the validation step occurs
before canonicalization occurs. An attacker could provide an input path
of "/safe_dir/../" that would pass the validation step. However, the
canonicalization process sees the double dot as a traversal to the
parent directory and hence when canonicized the path would become just
"/".
To avoid this problem, validation should occur after canonicalization
takes place. In this case canonicalization occurs during the
initialization of the File object. The code below fixes the
issue.
(Good Code)
Example
Language: Java
String path = getInputPath();
File f = new File(path);
if (f.getCanonicalPath().startsWith("/safe_dir/"))
Product checks URI for "<" and other literal
characters, but does it before hex decoding the URI, so "%3E" and other
sequences are allowed.
Potential Mitigations
Phase: Implementation
Strategy: Input Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass whitelist validation schemes by introducing dangerous inputs after they have been checked.
Description
