CWE-793: Only Filtering One Instance of a Special Element
The product receives data from an upstream component, but only filters a single instance of a special element before sending it to a downstream component.
Last updated
Overview
Incomplete filtering of this nature may be location-dependent, as in only the first or last element is filtered.
Common consequences
What can happen when CWE-793 is exploited.
Unexpected State
Affects: Integrity
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
Code examples
Illustrative examples from MITRE showing how the weakness appears in code.
The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.
Vulnerable example
my $Username = GetUntrustedInput();Attack input
../../../etc/passwdResulting query
../../etc/passwdResulting query
/home/user/../../etc/passwd