CWE-180 (不正确的行为次序：规范化之前验证) — Vulnerability Class 20

CWE-180 represents a critical logic flaw where software validates input data before normalizing or canonicalizing it. This sequencing error allows attackers to bypass security controls by submitting specially crafted inputs that appear valid in their raw form but transform into malicious payloads after canonicalization. For instance, an attacker might use encoded characters that pass initial validation checks but resolve to dangerous sequences, such as SQL injection strings or path traversal sequences, once the system processes them. To mitigate this vulnerability, developers must strictly enforce a canonicalization-first approach. By normalizing input data before applying any validation rules, applications ensure that security checks operate on the final, resolved form of the data. This practice effectively neutralizes evasion techniques that rely on encoding or transformation, ensuring that all potential threats are detected and blocked consistently.