This weakness occurs when software validates user input at one point, but later processing steps modify or reinterpret that input in ways that bypass the…
This weakness occurs when software validates user input at one point, but later processing steps modify or reinterpret that input in ways that bypass the earlier validation. An attacker can craft input that passes the initial check but becomes malicious after subsequent transformations, reaching sensitive operations unprotected. This is a logic flaw, not a single coding mistake — it's about the *order* in which operations happen.
Validation typically happens early in request handling for performance and clarity reasons. However, if later code normalizes, decodes, transforms, or reinterprets the input (e.g., URL decoding, case conversion, whitespace stripping, character entity decoding), the validated form may differ from the form that reaches the sensitive operation. An attacker can exploit this gap by encoding or structuring their payload so it passes the early check but becomes dangerous after transformation. The root cause is that validation and transformation are not synchronized — the validator checks one representation, but the sensitive code uses a different one.
This flaw can lead to authentication bypass, authorization circumvention, injection attacks, or path traversal. For example, a file path validator might check that a filename doesn't contain ../, but if the path is later URL-decoded or case-normalized, a previously safe string could become a directory traversal payload. Similarly, a SQL injection filter might block certain keywords, but if the input is later unescaped or decoded, the filter becomes ineffective. The impact depends on what the sensitive operation does and what transformation occurs.
import urllib.parse
def process_user_file(encoded_path):
# Validation happens here, on the encoded form
if "../" in encoded_path or ".." in encoded_path:
raise ValueError("Path traversal detected")
# Later, the path is decoded — validation is now bypassed
decoded_path = urllib.parse.unquote(encoded_path)
# Sensitive operation uses the decoded form
with open(f"/uploads/{decoded_path}", "r") as f:
return f.read()
# Attacker sends: "..%2F..%2Fetc%2Fpasswd"
# Passes validation (no "../" in encoded form)
# After decode: "../../etc/passwd" — traversal succeedsWhy it's vulnerable:
The validation checks the URL-encoded form, but the sensitive file operation uses the decoded form. The attacker's payload is safe in one representation but dangerous in another.
import urllib.parse
import os
def process_user_file(encoded_path):
# Decode first
decoded_path = urllib.parse.unquote(encoded_path)
# Validate the decoded form
if "../" in decoded_path or ".." in decoded_path:
raise ValueError("Path traversal detected")
# Ensure the resolved path stays within the allowed directory
base_dir = "/uploads"
full_path = os.path.normpath(os.path.join(base_dir, decoded_path))
if not full_path.startswith(os.path.normpath(base_dir)):
raise ValueError("Path traversal detected")
with open(full_path, "r") as f:
return f.read()function process_user_file($encoded_path) {
// Validation on the encoded form
if (strpos($encoded_path, "../") !== false || strpos($encoded_path, "..") !== false) {
die("Path traversal detected");
}
// Later, the path is decoded — validation is bypassed
$decoded_path = urldecode($encoded_path);
// Sensitive operation uses the decoded form
$file = "/uploads/" . $decoded_path;
echo file_get_contents($file);
}
// Attacker sends: "..%2F..%2Fetc%2Fpasswd"
// Passes validation (no "../" in encoded form)
// After decode: "../../etc/passwd" — traversal succeedsWhy it's vulnerable:
The check runs on the URL-encoded string, but the file operation uses the decoded string. The two representations are different, and validation doesn't account for the transformation.
function process_user_file($encoded_path) {
// Decode first
$decoded_path = urldecode($encoded_path);
// Validate the decoded form
if (strpos($decoded_path, "../") !== false || strpos($decoded_path, "..") !== false) {
die("Path traversal detected");
}
// Use realpath to resolve and verify the path stays in bounds
$base_dir = realpath("/uploads");
$full_path = realpath("/uploads/" . $decoded_path);
if ($full_path === false || strpos($full_path, $base_dir) !== 0) {
die("Path traversal detected");
}
echo file_get_contents($full_path);
}os.path.normpath() (Python) or realpath() (PHP) handle canonicalization safely and reduce the risk of logic gaps.
Look for unexpected file access outside intended directories, unusual entries in access logs showing encoded or obfuscated paths, or security test results flagging path traversal or injection bypasses despite input filters being in place. If a validation rule exists but penetration tests can still bypass it using encoded or transformed payloads, this weakness may be present.
