CWE-551 (不正确的行为次序：在解析与净化处理之前进行授权) — Vulnerability Class 12

CWE-551 represents a critical logic flaw where an application performs authorization checks before fully parsing and canonicalizing user input, such as URLs. This sequence error allows attackers to bypass security controls by exploiting ambiguities in path interpretation. For example, if a system checks permissions for “/ProtectedDir” but fails to normalize “/./ProtectedDir” into the same canonical form, an attacker may gain unauthorized access to restricted resources. Exploitation typically involves submitting malformed or redundant path segments that the authorization module ignores but the file system resolves correctly. Developers prevent this by strictly enforcing a canonicalization step prior to any security validation. By normalizing all inputs to a standard format first, applications ensure that authorization decisions are based on the true, resolved resource path, thereby closing the gap between logical access control and actual file system behavior.