The application must protect from canonical representation vulnerabilities.
An XCCDF Rule
Description
<VulnDiscussion>Canonical representation vulnerabilities can occur when a data conversion process does not convert the data to its simplest form resulting in the possible misrepresentation of the data. The application may behave in an unexpected manner when acting on input that has not been sanitized or normalized. Vulnerable application code is written to expect one form of data and executes its program logic on another form of data thereby creating instability or unexpected behavior. The Open Web Application Security Project (OWASP) website provides test and remediation procedures that can be used for testing if vulnerability scan tools or results are not available. The site is available by pointing your browser to https://www.owasp.org.</VulnDiscussion><FalsePositives></FalsePositives><FalseNegatives></FalseNegatives><Documentable>false</Documentable><Mitigations></Mitigations><SeverityOverrideGuidance></SeverityOverrideGuidance><PotentialImpacts></PotentialImpacts><ThirdPartyTools></ThirdPartyTools><MitigationControl></MitigationControl><Responsibility></Responsibility><IAControls></IAControls>
- ID
- SV-222605r879652_rule
- Severity
- Medium
- References
- Updated
Remediation - Manual Procedure
A suitable canonical form should be chosen and all user input canonicalized into that form before any authorization decisions are performed.
Security checks should be carried out after decoding is completed. Moreover, it is recommended to check that the encoding method chosen is a valid canonical encoding for the symbol it represents.