CWE-792 is a variant of incomplete filtering. The product does not filter one or more instances of special elements before passing data downstream.
MITRE describes two shapes: only one instance of a special element is filtered when more exist, or not all instances or all elements are filtered when several kinds are present.
How it happens
The most common cause is a function that acts once. In many languages, a simple replace call with a first-match behavior removes only the first hit.
const cleaned = input.replace("'", ""); // string pattern: first match only
Given a'b'c, the result is ab'c. One quote is still there. The fix looks tiny, but missing it is easy because the code seems to work in a quick test with a single quote.
The second shape is a filter that handles quotes and forgets semicolons, or handles one of several characters the downstream parser cares about.
This entry has two children, which split the problem. CWE-793 covers filtering only one instance. CWE-794 covers not filtering all instances of a special element.
What an attacker gains
The record lists integrity and unexpected state. There are no observed CVEs in it. The impact is determined by the downstream interpreter: a surviving element can change a query, command or document structure.
How to find it
- Read each filter and ask what happens with two or three of the same element in a row, and with different elements mixed together.
- Add unit tests that repeat the dangerous input several times.
- Search for replace or strip calls used as security controls.
How to fix it
- Use a replace that covers all matches, and keep in mind that removal can reveal a new match.
- Better, do not strip. Reject input that contains disallowed elements, or encode it.
- Handle all special elements for the destination, not a subset.
- Prefer the destination's own safe interface, such as bound parameters, so there is no filter to be incomplete.
const cleaned = input.replaceAll("'", "''"); // for a SQL string context, as a last resort
Even this is a fallback. Bound parameters are the right answer for SQL.
Quick check
Why did the one-quote test pass?
It had a single special element, so a first-match replace removed everything. Tests need repeated and mixed elements.
