CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

Variant Incomplete Simple

CWE版本: 4.18

更新日期: 2025-09-09

弱点描述

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.

扩展描述

As data is parsed, an injected/absent/malformed delimiter may cause the process to take unexpected actions.

常见后果

影响范围: Integrity

技术影响: Unexpected State

潜在缓解措施

描述: Developers should anticipate that escape, meta and control characters/sequences will be injected/removed/manipulated in the input vectors of their product. Use an appropriate combination of denylists and allowlists to ensure only valid, expected and appropriate input is processed by the system.

阶段: Implementation

策略: Input Validation

阶段: Implementation

策略: Output Encoding

描述: While it is risky to use dynamically-generated query strings, code, or commands that mix control and data together, sometimes it may be unavoidable. Properly quote arguments and escape any special characters within those arguments. The most conservative approach is to escape or filter all characters that do not pass an extremely strict allowlist (such as everything that is not alphanumeric or white space). If some special characters are still needed, such as white space, wrap each argument in quotes after the escaping/filtering step. Be careful of argument injection (CWE-88).

阶段: Implementation

策略: Input Validation

描述: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.

观察示例

参考: CVE-2002-0542

The mail program processes special "~" escape sequence even when not in interactive mode.

参考: CVE-2000-0703

Setuid program does not filter escape sequences before calling mail program.

参考: CVE-2002-0986

Mail function does not filter control characters from arguments, allowing mail message content to be modified.

参考: CVE-2003-0020

Multi-channel issue. Terminal escape sequences not filtered from log files.

参考: CVE-2003-0083

Multi-channel issue. Terminal escape sequences not filtered from log files.

参考: CVE-2003-0021