CWE-85 (双字符XSS操纵) — Vulnerability Class 2

CWE-85 represents a critical input validation weakness where web applications fail to adequately sanitize user-controlled data by ignoring doubled characters used to obfuscate malicious scripts. Attackers typically exploit this vulnerability by encoding special characters, such as replacing a single quote with two identical quotes, to bypass naive filtering mechanisms that only check for single instances of dangerous syntax. This manipulation allows the injected script to execute within the victim’s browser, leading to cross-site scripting attacks that can compromise user sessions or steal sensitive information. To prevent this, developers must implement robust, context-aware input validation and output encoding strategies that normalize and escape all special characters regardless of their repetition. Utilizing established security libraries and adhering to the principle of least privilege ensures that even obfuscated payloads are correctly interpreted as data rather than executable code, effectively neutralizing this evasion technique.