CWE-186
Overly Restrictive Regular Expression
2006-07-19
00h00 +00:00
00h00 +00:00
指定 CWE 通知
掌握特定 CWE 的任何變更。
名稱: Overly Restrictive Regular Expression
A regular expression is overly restrictive in a way that does not match all intended values.
一般資訊
引入方式
Implementation適用平台
程式語言
類別： Not Language-Specific (Undetermined)常見後果
| 範圍 | 影響 | 可能性 |
|---|---|---|
| Access Control | Bypass Protection Mechanism, Varies by Context 注意： An overly restrictive regexp misses some potentially security-relevant values, leading to either false positives *or* false negatives, depending on how the regexp is being used within the code. |
觀察到的案例
| 參考資料 | 描述 |
|---|---|
CVE-2005-1604 | MIE. ".php.ns" bypasses ".php$" regexp but is still parsed as PHP by Apache. (manipulates an equivalence property under Apache) |
潛在緩解措施
Phases : ImplementationRegular expressions can become error prone when defining a complex language even for those experienced in writing grammars. Determine if several smaller regular expressions simplify one large regular expression. Also, subject your regular expression to thorough testing techniques such as equivalence partitioning, boundary value analysis, and robustness. After testing and a reasonable confidence level is achieved, a regular expression may not be foolproof. If an exploit is allowed to slip through, then record the exploit and refactor your regular expression.
漏洞對應備注
理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
備注
Can overlap allowlist/denylist errors (CWE-183/CWE-184)提交
| 名稱 | 機構 | 日期 | 發布日期 | Version |
|---|---|---|---|---|
| PLOVER | Draft 3 |
修改記錄
| 名稱 | 機構 | 日期 | 備註 |
|---|---|---|---|
| Eric Dalci | Cigital | updated Potential_Mitigations, Time_of_Introduction | |
| CWE Content Team | MITRE | updated Relationships, Relationship_Notes, Taxonomy_Mappings | |
| CWE Content Team | MITRE | updated Common_Consequences | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Applicable_Platforms | |
| CWE Content Team | MITRE | updated Description | |
| CWE Content Team | MITRE | updated Description, Relationships | |
| CWE Content Team | MITRE | updated Relationship_Notes | |
| CWE Content Team | MITRE | updated Relationships | |
| CWE Content Team | MITRE | updated Mapping_Notes | |
| CWE Content Team | MITRE | updated Weakness_Ordinalities | |
| CWE Content Team | MITRE | updated Potential_Mitigations | |
| CWE Content Team | MITRE | updated Common_Consequences, Demonstrative_Examples, Description |
