CWE-76 (等价特殊元素的转义处理不恰当) — Vulnerability Class 9

CWE-76 represents a logic flaw where software filters specific special characters but fails to account for their equivalent representations, such as alternate encodings or case variations. Attackers exploit this oversight by substituting blocked characters with functionally identical alternatives, thereby bypassing input validation mechanisms. For instance, if a system blocks forward slashes to prevent path traversal but ignores double slashes or encoded variants, an adversary can inject malicious paths that the application interprets as valid. To mitigate this vulnerability, developers must implement comprehensive normalization strategies that resolve all equivalent forms before validation. This involves canonicalizing input data to a single standard representation and ensuring that filtering logic accounts for all possible encodings, including Unicode variations and URL encoding, rather than relying on static lists of prohibited characters.