Canonicalization
Converting input to one standard form before checking it, for example decoding percent-encoding, normalizing Unicode and resolving ../ segments in a path. Validating before canonicalizing lets an encoded payload pass the check and take effect later (CWE-180).
- Defined in
- MITRE CWE-180
Covered in
Extract archives without escaping the destination
Prevent traversal, link tricks, overwrites and decompression exhaustion while preserving legitimate file extraction.
Validate input safely and prevent regex denial of service
Find and fix exponential and quadratic regex backtracking with measured examples, choose linear-time engines or timeouts, and build allowlist validation that decodes once and rejects type confusion and parameter pollution.
Practice: Path traversal lab: Keep archive entries inside their extraction directory · Path traversal lab: Serve an uploaded file without path traversal · Local project: Keep extracted files inside their boundary · Local project: Convert untrusted documents in a locked-down container