Validating Input After Canonicalization Matters
Validate input after canonicalization, not before. Security checks should inspect the same form of data the application will use. MITRE lists this ordering issue as CWE-180, which covers validation before canonicalization and can contribute to problems such as path traversal.…