Szczegóły CWE-178

The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

Sposoby wprowadzenia

Implementation

Odpowiednie platformy

Język

Class: Not Language-Specific (Undetermined)

Systemy operacyjne

Class: Windows (Undetermined)
Class: macOS (Undetermined)

Technologie

Class: Not Technology-Specific (Undetermined)

Typowe konsekwencje

Zaobserwowane przykłady

Potencjalne środki zaradcze

Phases : Architecture and Design
Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
Phases : Implementation
Phases : Implementation
Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

Uwagi dotyczące mapowania podatności

Uzasadnienie : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Komentarz : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Notatki

These are probably under-studied in Windows and Mac environments, where file names are case-insensitive and thus are subject to equivalence manipulations involving case.

Zgłoszenie

Modyfikacje