CWE-625: Permissive Regular Expression
Description
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include: not identifying the beginning and end of the target string using wildcards instead of acceptable character ranges others
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- Access Control
Bypass Protection Mechanism
Potential mitigations
- Implementation
When applicable, ensure that the regular expression marks beginning and ending string patterns, such as /^string$/ for Perl.
Related weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.