CWE-167 (附加特殊元素净化处理不恰当) — Vulnerability Class 5

CWE-167 represents an input validation weakness where software fails to properly manage unexpected special elements within structured data, such as XML or JSON. Attackers typically exploit this by injecting malicious or malformed special characters that disrupt parsing logic, potentially leading to denial-of-service conditions, data corruption, or injection attacks like XML External Entity (XXE) vulnerabilities. To mitigate this risk, developers must implement strict input validation and sanitization routines that explicitly define allowed character sets and structural formats. Utilizing robust, well-maintained parsing libraries rather than custom regex solutions helps ensure consistent handling of edge cases. Additionally, enforcing schema validation and applying the principle of least privilege to data processing components further reduces the attack surface, ensuring that only expected, safe inputs are processed by the application.