CWE-173 (候选编码方案处理不恰当) — Vulnerability Class 3

CWE-173 represents a critical input validation weakness where software fails to properly normalize or interpret alternate character encodings before processing. Attackers typically exploit this by injecting malicious payloads using alternative encodings, such as Unicode or UTF-7, which bypass standard security filters that only check for the primary encoding format. This discrepancy allows attackers to execute cross-site scripting, SQL injection, or command injection attacks that would otherwise be blocked. To mitigate this risk, developers must implement robust input normalization strategies that convert all incoming data to a single, canonical encoding before validation. Additionally, applying strict allow-lists for acceptable characters and ensuring that security controls operate on the normalized data rather than the raw input are essential practices. By standardizing encoding handling early in the processing pipeline, organizations can effectively neutralize encoding-based evasion techniques and secure their applications against these sophisticated bypass methods.