Path Equivalence: 'file name' (Internal Whitespace)

File systems and security filters often handle paths with internal spaces inconsistently. An attacker can submit a path like 'important document' when the system expects 'important_document' or 'important%20document'. This mismatch can trick the application's validation logic, allowing the request to proceed to the underlying operating system, which may resolve it to a legitimate but unintended file. To prevent this, developers must normalize and strictly validate all user-supplied path inputs before processing. Implement a canonicalization step that removes or rejects internal whitespace, and use allowlists for permitted directory locations. Never rely solely on blacklisting specific characters or patterns, as file system interpretation can vary across platforms.