logo

Improper Filtering of Special Elements

Incomplete Class
Structure: Simple
Description

This vulnerability occurs when an application accepts data from a source but fails to properly sanitize or incorrectly filters out special characters or control elements before passing that data to another system component.

Extended Description

At its core, this weakness is about a broken chain of trust in data handling. An application often assumes data from an upstream component (like a user, another service, or a database) is safe, but it must actively validate and neutralize potentially dangerous elements—such as quotes, brackets, script tags, or command delimiters—before that data flows downstream. If this filtering step is missing or flawed, the downstream component interprets these special elements as part of its own commands or code, leading to security breaches. For developers, this means you cannot rely on the source of your data. You must implement context-aware filtering or encoding at the point where data is used. For example, data destined for SQL needs parameterized queries, data for HTML output needs HTML entity encoding, and data for system commands needs strict allow-list validation. The fix isn't a single filter; it's applying the correct defense for each specific output context to prevent injections, cross-site scripting (XSS), and command execution attacks.
Common Consequences 1
Scope: Integrity

Impact: Unexpected State
Demonstrative Examples 1

ID : DX-2

The following code takes untrusted input and uses a regular expression to filter "../" from the input. It then appends this result to the /home/user/ directory and attempts to read the file in the final resulting path.

Code Example:

Bad
Perl
perl
Since the regular expression does not have the /g global match modifier, it only removes the first instance of "../" it comes across. So an input value such as:

Code Example:

Attack
bash
will have the first "../" stripped, resulting in:

Code Example:

Result
bash
This value is then concatenated with the /home/user/ directory:

Code Example:

Result
bash
which causes the /etc/passwd file to be retrieved once the operating system has resolved the ../ sequences in the pathname. This leads to relative path traversal (Relative Path Traversal).
Modes of Introduction
Implementation
Related Weaknesses
ChildOf: Improper Neutralization of Special Elements (CWE-138)