CWE-178 Detail

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Modes Of Introduction

Implementation

Piattaforme applicabili

Linguaggio

Class: Not Language-Specific (Undetermined)

Sistemi operativi

Class: Windows (Undetermined)
Class: macOS (Undetermined)

Tecnologie

Class: Not Technology-Specific (Undetermined)

Conseguenze comuni

Esempi osservati

Potential Mitigations

Phases : Architecture and Design
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Phases : Implementation
Phases : Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Note sulla mappatura delle vulnerabilità

Giustificazione : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Commento : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Note

These are probably under-studied in Windows and Mac environments, where file names are case-insensitive and thus are subject to equivalence manipulations involving case.

Invio

Modifiche