CWE-795 describes a filter that only accounts for special elements at a specified location, which means it misses any that appear elsewhere in the data.
MITRE gives two ways the location can be defined: relative to a marker, such as the beginning or end of a string or the second argument, or at an absolute position, such as byte number 10.
How it happens
Developers assume where the dangerous part will be. A leading dot for hidden files. A trailing slash. The first argument to a command. The filter checks that spot and passes the rest.
def safe_name(name):
if name.startswith("."):
raise ValueError("hidden file")
return name # nothing checks the middle or end
A name such as reports/../../etc/passwd has no leading dot and sails through.
This entry has two children, CWE-796 for markers and CWE-797 for absolute positions.
What an attacker gains
The record lists integrity and an unexpected state, and no observed CVEs. Special elements that sit outside the checked location stay in the data and reach the downstream component.
How to find it
- For every filter, write down which part of the input it examines. If the answer is not "all of it", look closer.
- Test by moving a dangerous element to the start, middle, end and second position.
- Look at argument handling in code that builds commands or queries.
How to fix it
- Inspect the entire value, not a slice.
- Allowlist characters or patterns for the full input, using an anchored pattern. See CWE-777 for why anchoring matters.
- Use the destination's safe API so location no longer matters: argument arrays for processes, bound parameters for queries, path resolution plus a directory containment check for files.
- Add tests that vary the position of each special element.
Quick check
Why is checking only the start of a string unsafe?
Dangerous elements can sit anywhere in the data, and the downstream component will still act on them.
