CWE-97: Failure to Sanitize Server-Side Includes (SSI) Within a Web Page
Failure to Sanitize Server-Side Includes (SSI) Within a Web Page
Weakness ID: 97 (Weakness Base)
Status: Draft
Description
Description Summary
The software fails to adequately filter server-side include
(control-plane) syntax from user-controlled input (data plane) and then allows
potentially injected server-side includes to be acted
upon.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Potential Mitigations
Phase
Description
Implementation
Utilize an appropriate mix of white-list and black-list parsing to
filter server-side include syntax from all input.
This can be resultant from XSS/HTML injection because the same special
characters can be involved. However, this is server-side code execution, not
client-side.
Description
