CWE-155 (双字符或匹配符号转义处理不恰当) — Vulnerability Class 13

CWE-155 represents a critical input validation weakness where software fails to properly sanitize special characters, such as wildcards or matching symbols, before passing them to downstream components. Attackers typically exploit this vulnerability by injecting malicious patterns that alter the intended behavior of the receiving system, potentially leading to unauthorized data access, denial of service, or remote code execution. For instance, an attacker might use a wildcard character to bypass file access controls or manipulate search queries to expose sensitive information. To mitigate this risk, developers must implement strict input validation and output encoding strategies. By explicitly defining allowed character sets and neutralizing potentially dangerous symbols before they reach interpretable contexts, engineers can prevent unintended interpretation and ensure that user-supplied data remains inert and safe within the application’s processing pipeline.