CWE-1474 Non-Equivalent Data Transformation

The product parses or transforms data into another format, structure, or representation, but the newly-produced data is not semantically equivalent to the original data.

• Integrity, Other: Bypass Protection Mechanism, Unexpected State, Varies by Context — The consequences vary depending on how the transformed data is intended to be used. If the data influences behavior of the product such as affecting how a security decision is made, then this could bypass an intended protection mechanism.

• [Architecture and Design, Implementation] Validate the transformed data against what was expected to be produced. If the data is complex and free-form with some "special elements" in them, consider re-parsing the output to ensure that it matches expectations.

• Manual Analysis: Examine inputs that will be saved or otherwise processed, then look at how they are produced in output. Analyze outputs that are expected to be (1) unchanged from the inputs, or (2) changed in a controlled way. Consider analyzing the data to extract key elements, such as e-mail addresses or domain names, to ensure that they are consistent with the original input. • Automated Dynamic Analysis: Examine inputs that will be saved or otherwise processed, then look at how they are produced in output. Analyze outputs that are expected to be (1) unchanged from the inputs, or (2) changed in a controlled way. Consider analyzing the data to extract key elements, such as e-mail addresses or domain names, to ensure that they are consistent with the original input.

• CVE-2022-48279: Web Application Firewall (WAF) does not parse HTTP multipart requests correctly, allowing bypass. • CVE-2022-24723: JavaScript URL library does not correctly parse URLs with leading whitespace.