The product uses a regular expression that does not sufficiently restrict the set of allowed values.
Extended Description
This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include:
not identifying the beginning and end of the target string
using wildcards instead of acceptable character ranges
others
Time of Introduction
Implementation
Applicable Platforms
Languages
Perl
PHP
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism
Demonstrative Examples
Example 1
(Bad Code)
Example
Language: Perl
$phone = GetPhoneNumber();
if ($phone =~ /\d+-\d+/) {
# looks like it only has hyphens and digits
system("lookup-phone $phone");
}
else {
error("malformed number!");
}
An attacker could provide an argument such as: "; ls -l ; echo
123-456" This would pass the check, since "123-456" is sufficient to
match the "\d+-\d+" portion of the regular expression.
insertion of username into regexp results in
partial comparison, causing wrong database entry to be updated when one
username is a substring of another.
Description
