CWE-142 covers products that receive input from an upstream component but do not neutralize, or incorrectly neutralize, special elements that could be read as value delimiters by a downstream component. It is a variant of CWE-140 and is not tied to a language.
How it happens
A value delimiter separates one value from the next, for example a comma in a list or a space between words. If a value itself contains the delimiter and nothing quotes or escapes it, the reader sees two values.
MITRE's observed example is CVE-2000-0293: multiple internal spaces and insufficient quoting, where the program does not use a proper delimiter between values.
# Vulnerable: values joined with spaces, no quoting
entry = " ".join([user, host, shell])
# user = "alice /bin/sh" shifts every following field by one
When fields shift, the program may read the host as the shell, or a value from the user as a setting. MITRE notes that an injected, absent or malformed delimiter may cause the process to take unexpected actions.
What an attacker gains
The listed consequence is an integrity impact with an unexpected state. Values end up in the wrong fields. That can change a setting, break a check that relied on field position, or make the program use data from the wrong source.
How to find it
- Look for code that joins values with a plain separator and no quoting.
- Test each field with the separator itself, with multiple adjacent separators, and with leading or trailing separators.
- Check that the reader and the writer agree on how an empty value and an escaped separator look.
How to fix it
- Use a serializer for the format, such as a CSV library or JSON, so quoting is done by tested code.
- Where the format has no quoting, reject values that contain the delimiter.
- Keep writer and reader on one shared definition of the format.
- Validate each value before it is stored.
Quick check
What goes wrong when a value contains the delimiter?
The reader splits it into two values, so every later field shifts and the program may use data in the wrong role.
