CWE-86: Failure to Sanitize Invalid Characters in Identifiers in Web Pages
Failure to Sanitize Invalid Characters in Identifiers in Web Pages
Weakness ID: 86 (Weakness Variant)
Status: Draft
Description
Description Summary
The software does not strip out invalid characters in the
middle of tag names, URI schemes, and other identifiers, which are still
rendered by some web browsers that ignore the characters. Some commonly used
characters include null, CRLF, and other non-standard
whitespace.
XSS filter doesn't filter null characters before
looking for dangerous tags, which are ignored by web browsers. Multiple
Interpretation Error (MIE) and
validate-before-cleanse.
Potential Mitigations
Phase
Description
see the vulnerability category "Cross-site scripting (XSS)"
Description
