CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
Description
The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.
- Abstraction
- VariantA weakness tied to a specific language, technology or resource.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access Control
Bypass Protection Mechanism
Potential mitigations
- ImplementationInput Validation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
- CAPEC-3Using Leading 'Ghost' Character Sequences to Bypass Input Filters
- CAPEC-71Using Unicode Encoding to Bypass Validation Logic
- CAPEC-78Using Escaped Slashes in Alternate Encoding
- CAPEC-79Using Slashes in Alternate Encoding
- CAPEC-80Using UTF-8 Encoding to Bypass Validation Logic
- CAPEC-267Leverage Alternate Encoding