CWE-186 (过度严格的正则表达式) — Vulnerability Class 1

CWE-186 represents a validation weakness where a regular expression is excessively restrictive, failing to match all intended input patterns. This flaw typically arises when developers craft patterns that inadvertently exclude valid data or, more critically, fail to detect malicious payloads that fall outside the narrow defined scope. Attackers exploit this by crafting inputs that bypass the flawed validation logic, allowing dangerous characters or structures to enter the system undetected. To mitigate this risk, developers must rigorously test regex patterns against comprehensive input datasets, including edge cases and known attack vectors. Utilizing established, well-vetted libraries for common validation tasks rather than writing custom expressions from scratch significantly reduces the likelihood of oversight. Additionally, employing defense-in-depth strategies ensures that even if validation fails, subsequent processing layers can still prevent security breaches.