CWE-180
Incorrect Behavior Order: Validate Before Canonicalize
AI Translation Available
The product validates input before it is canonicalized, which prevents the product from detecting data that becomes invalid after the canonicalization step.
Status
draft
Abstraction
variant
Affected Platforms
Extended Description
AI Translation
This can be used by an attacker to bypass the validation and launch attacks that expose weaknesses that would otherwise be prevented, such as injection.
Technical Details
AI Translation
Common Consequences
access control
Impacts
bypass protection mechanism
Potential Mitigations
Phases:
implementation
Descriptions:
•
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.