CWE-165 is the case where multiple special elements appear inside a value and the product does not neutralize them. It is the repeated version of CWE-164. A filter built to handle one internal element may fail when it sees two, three or twenty in a row.
Anyone who removes or replaces special characters in input should look at how the code behaves on repeats.
How it happens
A common mistake is a single pass replacement. The code removes one occurrence of a pattern, or one pass of a pattern, and assumes the job is done. Repeated or overlapping elements leave something behind, or removing one creates a new one.
The record lists no observed examples for this entry, so there are no CVE cases to cite. MITRE states the mechanism: as data is parsed, improperly handled multiple internal special elements may cause the process to take unexpected actions that result in an attack.
What an attacker gains
The record lists integrity impact as unexpected state. What follows depends on what the downstream parser does with the leftover elements.
How to find it
No detection methods are listed. Use these tests.
- Send each special sequence repeated, interleaved and nested in the middle of values.
- Look at filters that call replace once. Run the output through the filter a second time and see whether it changes.
- Compare the validator's view of the final value with the consumer's view.
How to fix it
- Anticipate that multiple internal special elements will be injected or manipulated.
- Prefer rejecting input that does not match a strict allowlist over trying to clean it.
- If you must transform, repeat until the value stops changing, then validate the result.
- Escape for the destination at the output boundary.
Quick check
Why does a single replacement pass fail?
Removing one occurrence can leave a valid one behind, or splice the remaining characters into a new one. Reject non conforming input instead.
