CWE-1286: Improper Validation of Syntactic Correctness of Input
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product receives input that is expected to be well-formed - i.e., to comply with a certain syntax - but it does not validate or incorrectly validates that the input complies with the syntax.
常见后果
影响范围: Other
技术影响: Varies by Context
潜在缓解措施
阶段: Implementation
策略: Input Validation
有效性: High
观察示例
参考: CVE-2016-4029
Chain: incorrect validation of intended decimal-based IP address format (CWE-1286) enables parsing of octal or hexadecimal formats (CWE-1389), allowing bypass of an SSRF protection mechanism (CWE-918).
参考: CVE-2007-5893
HTTP request with missing protocol version number leads to crash
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | - |