CWE-625 — Permissive Regular Expression
CWE-625: Permissive Regular Expression
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Base |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product uses a regular expression that does not sufficiently restrict the set of allowed values.
This effectively causes the regexp to accept substrings that match the pattern, which produces a partial comparison to the target. In some cases, this can lead to other weaknesses. Common errors include: not identifying the beginning and end of the target string using wildcards instead of acceptable character ranges others
Common consequences
- Access Control: Bypass Protection Mechanism
Mitigations
Implementation — When applicable, ensure that the regular expression marks beginning and ending string patterns, such as "/^string$/" for Perl.
References
- CWE page: https://cwe.mitre.org/data/definitions/625.html
- CWE list: https://cwe.mitre.org/data/index.html