CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Incorrect Behavior Order: Validate Before Canonicalize
Weakness ID: 180 (Weakness Base)
Status: Draft
Description
Description Summary
The software validates input before it is canonicalized, which
prevents the software from detecting data that becomes invalid after the
canonicalization step.
Extended Description
This can be used by an attacker to bypass the validation and launch
attacks that expose weaknesses that would otherwise be prevented, such as
injection.
Product checks URI for "<" and other
literal characters, but does it before hex decoding the URI, so "%3E" and
other sequences are allowed.
Potential Mitigations
Phase
Description
Inputs should be decoded and canonicalized to the application's
current internal representation before being validated. Make sure that
your application does not decode the same input twice. Such errors could
be used to bypass whitelist schemes by introducing dangerous inputs
after they have been checked.
Description
