The product defines policy namespaces and makes authorization decisions based on the assumption that a URL is canonical. This can allow a non-canonical URL to bypass the authorization.
Make access control policy based on path information in canonical form. Use very restrictive regular expressions to validate that the path is in the expected form.
Reject all alternate path encodings that are not in the expected canonical form.
Our security experts can help you identify and remediate CWE-647 vulnerabilities in your codebase.
Get Security Assessment