CWE-183 (宽松定义的白名单) — Vulnerability Class 28

CWE-183 represents a critical input validation weakness where an application’s security mechanism relies on an overly permissive allowlist of acceptable inputs. Instead of strictly permitting only known-safe values, this flawed approach inadvertently includes dangerous data that violates security policies, thereby assuming safety without sufficient verification. Attackers typically exploit this vulnerability by crafting malicious inputs that fall within the broad, accepted range but contain hidden payloads, such as injection code or path traversal sequences. These inputs bypass initial checks and trigger downstream security failures like cross-site scripting or command injection. To mitigate this risk, developers must implement strict, granular allowlists that precisely define valid inputs, avoiding broad patterns or wildcards. Additionally, employing defense-in-depth strategies, such as output encoding and parameterized queries, ensures that even if a permissive check fails, the system remains resilient against exploitation.