CWE-84 (Web页面编码URIScheme转义处理不恰当) — Vulnerability Class 10

CWE-84 represents an input validation weakness where web applications fail to properly sanitize user-controlled data containing encoded Uniform Resource Identifier (URI) schemes. Attackers typically exploit this vulnerability by embedding malicious scripts within specially crafted URLs that utilize URI encoding to bypass standard security filters. When the application processes this input without adequate neutralization, the encoded script executes in the victim’s browser, potentially leading to cross-site scripting (XSS) attacks, session hijacking, or unauthorized actions. To prevent such exploits, developers must implement robust input validation strategies that strictly whitelist allowed characters and schemes. Additionally, applying context-specific output encoding ensures that any user-supplied data is safely rendered by the browser. Regular security testing and the use of established libraries for URI parsing further mitigate the risk of executing unintended code through encoded URI schemes.