CWE-1289—Improper Validation of Unsafe Equivalence in Input

名称

Improper Validation of Unsafe Equivalence in Input

描述

The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

Attackers can sometimes bypass input validation schemes by finding inputs that appear to be safe, but will be dangerous when processed at a lower layer or by a downstream component. For example, a simple XSS protection mechanism might try to validate that an input has no "<script>" tags using case-sensitive matching, but since HTML is case-insensitive when processed by web browsers, an attacker could inject "<ScrIpT>" and trigger XSS.

常见后果

范围：

Other

影响：

Varies by Context

相关 CWE

• CWE-20Improper Input ValidationHigh
• CWE-41Improper Resolution of Path Equivalence
• CWE-178Improper Handling of Case Sensitivity