Input Canonicalization Before Security Decision
Description
Normalize and canonicalize all user-supplied structured input (URLs, IP addresses, domain names, file paths, type identifiers, protocol schemes) to a standard form before applying any security decision such as allowlist matching, denylist checking, or policy evaluation. Decoding, case folding, Unicode normalization, IP address format unification (dotted-decimal, hex, octal, IPv4-mapped IPv6), and scheme normalization must occur before the security check — not after. This prevents attackers from using encoding variants, aliasing, or alternate representations to bypass list-based security controls. The canonicalization order must be: decode all layers → normalize → validate against security policy → sanitize.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | The attacker must find an input representation that survives full canonicalization while still bypassing the security check — encoding tricks (URL-encoding, Unicode homoglyphs, octal IP notation, mixed-case evasion) are neutralized before the security decision is made, requiring the attacker to discover a novel bypass that operates at the semantic level rather than the syntactic level |
CWE Relationships
Verification
Review application source code for canonicalization/normalization calls that execute before security-relevant comparisons (allowlist checks, denylist checks, policy evaluations). Verify that the canonicalized form — not the raw input — is used in all subsequent security decisions.
# Expected: Canonicalization calls present before security-relevant comparisons
# Expected: Security list checks should reference canonicalized/normalized values, not raw input