{"@ID": "1474", "@Name": "Non-Equivalent Data Transformation", "@Abstraction": "Class", "@Structure": "Simple", "@Status": "Incomplete", "Description": "The product parses or transforms data into another format,\n\t    structure, or representation, but the newly-produced data\n\t    is not semantically equivalent to the original data.", "Related_Weaknesses": {"Related_Weakness": {"@Nature": "ChildOf", "@CWE_ID": "664", "@View_ID": "1000", "@Ordinal": "Primary"}}, "Applicable_Platforms": {"Language": {"@Class": "Not Language-Specific", "@Prevalence": "Undetermined"}, "Architecture": {"@Class": "Not Architecture-Specific", "@Prevalence": "Undetermined"}, "Technology": {"@Class": "Not Technology-Specific", "@Prevalence": "Undetermined"}}, "Modes_Of_Introduction": {"Introduction": [{"Phase": "Architecture and Design"}, {"Phase": "Implementation"}]}, "Common_Consequences": {"Consequence": {"Scope": ["Integrity", "Other"], "Impact": ["Bypass Protection Mechanism", "Unexpected State", "Varies by Context"], "Note": {"xhtml:p": "The consequences vary depending on how the\n\t\ttransformed data is intended to be used. If the data\n\t\tinfluences behavior of the product such as affecting\n\t\thow a security decision is made, then this could\n\t\tbypass an intended protection mechanism.", "#text_blocks": ["The consequences vary depending on how the\n\t\ttransformed data is intended to be used. If the data\n\t\tinfluences behavior of the product such as affecting\n\t\thow a security decision is made, then this could\n\t\tbypass an intended protection mechanism."]}}}, "Detection_Methods": {"Detection_Method": [{"Method": "Manual Analysis", "Description": {"xhtml:p": "Examine inputs that will be saved or\n\t\totherwise processed, then look at how they are\n\t\tproduced in output. Analyze outputs that are expected\n\t\tto be (1) unchanged from the inputs, or (2) changed in\n\t\ta controlled way. Consider analyzing the data to\n\t\textract key elements, such as e-mail addresses or\n\t\tdomain names, to ensure that they are consistent with\n\t\tthe original input.", "#text_blocks": ["Examine inputs that will be saved or\n\t\totherwise processed, then look at how they are\n\t\tproduced in output. Analyze outputs that are expected\n\t\tto be (1) unchanged from the inputs, or (2) changed in\n\t\ta controlled way. Consider analyzing the data to\n\t\textract key elements, such as e-mail addresses or\n\t\tdomain names, to ensure that they are consistent with\n\t\tthe original input."]}, "Effectiveness": "Moderate", "Effectiveness_Notes": {"xhtml:p": "These methods could have mixed results\n\t\tdepending on how the product receives the data,\n\t\ttransforms it, and outputs the data. It might require\n\t\tdomain-specific knowledge of the product's intended\n\t\tbehavior in order to determine if some transformations\n\t\twere correct. These methods could be time-consuming\n\t\tand not necessarily complete, but there might not be\n\t\twell-established and well-understood methods for some\n\t\tsubtypes of this weakness.", "#text_blocks": ["These methods could have mixed results\n\t\tdepending on how the product receives the data,\n\t\ttransforms it, and outputs the data. It might require\n\t\tdomain-specific knowledge of the product's intended\n\t\tbehavior in order to determine if some transformations\n\t\twere correct. These methods could be time-consuming\n\t\tand not necessarily complete, but there might not be\n\t\twell-established and well-understood methods for some\n\t\tsubtypes of this weakness."]}}, {"Method": "Automated Dynamic Analysis", "Description": {"xhtml:p": "Examine inputs that will be saved or\n\t\totherwise processed, then look at how they are\n\t\tproduced in output. Analyze outputs that are expected\n\t\tto be (1) unchanged from the inputs, or (2) changed in\n\t\ta controlled way. Consider analyzing the data to\n\t\textract key elements, such as e-mail addresses or\n\t\tdomain names, to ensure that they are consistent with\n\t\tthe original input.", "#text_blocks": ["Examine inputs that will be saved or\n\t\totherwise processed, then look at how they are\n\t\tproduced in output. Analyze outputs that are expected\n\t\tto be (1) unchanged from the inputs, or (2) changed in\n\t\ta controlled way. Consider analyzing the data to\n\t\textract key elements, such as e-mail addresses or\n\t\tdomain names, to ensure that they are consistent with\n\t\tthe original input."]}, "Effectiveness": "Moderate", "Effectiveness_Notes": {"xhtml:p": "These methods could have mixed results\n\t\tdepending on how the product receives the data,\n\t\ttransforms it, and outputs the data. It might require\n\t\tdomain-specific knowledge of the product's intended\n\t\tbehavior in order to determine if some transformations\n\t\twere correct. These methods could be time-consuming\n\t\tand not necessarily complete, but there might not be\n\t\twell-established and well-understood methods for some\n\t\tsubtypes of this weakness.", "#text_blocks": ["These methods could have mixed results\n\t\tdepending on how the product receives the data,\n\t\ttransforms it, and outputs the data. It might require\n\t\tdomain-specific knowledge of the product's intended\n\t\tbehavior in order to determine if some transformations\n\t\twere correct. These methods could be time-consuming\n\t\tand not necessarily complete, but there might not be\n\t\twell-established and well-understood methods for some\n\t\tsubtypes of this weakness."]}}]}, "Potential_Mitigations": {"Mitigation": {"Phase": ["Architecture and Design", "Implementation"], "Description": {"xhtml:p": "Validate the transformed data against what\n\t\twas expected to be produced. If the data is complex\n\t\tand free-form with some \"special elements\" in them,\n\t\tconsider re-parsing the output to ensure that it\n\t\tmatches expectations.", "#text_blocks": ["Validate the transformed data against what\n\t\twas expected to be produced. If the data is complex\n\t\tand free-form with some \"special elements\" in them,\n\t\tconsider re-parsing the output to ensure that it\n\t\tmatches expectations."]}}}, "Demonstrative_Examples": {"Demonstrative_Example": {"Intro_Text": {"xhtml:p": "Consider a product that uses an\n\t      automated language translation service that is used to\n\t      translate vendor-controlled web pages that are used for\n\t      technical support. Consider that these web pages include\n\t      domain names and email addresses for users to\n\t      access.", "#text_blocks": ["Consider a product that uses an\n\t      automated language translation service that is used to\n\t      translate vendor-controlled web pages that are used for\n\t      technical support. Consider that these web pages include\n\t      domain names and email addresses for users to\n\t      access."]}, "Example_Code": [{"@Nature": "Bad", "@Language": "Algorithm", "xhtml:p": "The product invokes the translation service\n\t\ton the entire message text without any special\n\t\ttreatment or consideration for contact information\n\t\tsuch as email addresses and domain.", "#text_blocks": ["The product invokes the translation service\n\t\ton the entire message text without any special\n\t\ttreatment or consideration for contact information\n\t\tsuch as email addresses and domain."]}, {"@Nature": "Good", "@Language": "Algorithm", "xhtml:p": "The code could be changed to mark which words\n\t\tor phrase should not be translated. Alternately, the\n\t\toriginal web pages could be structured in a way that\n\t\tuses templates that insert non-translatable data such\n\t\tas email addresses. A third option could be to analyze\n\t\tthe resulting output and compare expected data\n\t\telements against an allowlist of known-valid\n\t\tvalues.", "#text_blocks": ["The code could be changed to mark which words\n\t\tor phrase should not be translated. Alternately, the\n\t\toriginal web pages could be structured in a way that\n\t\tuses templates that insert non-translatable data such\n\t\tas email addresses. A third option could be to analyze\n\t\tthe resulting output and compare expected data\n\t\telements against an allowlist of known-valid\n\t\tvalues."]}], "Body_Text": {"xhtml:p": "If the translation is from English to Polish,\n\t\tthen \"example.com\" might be translated to\n\t\t\"przyklad.com\" - a different web site\n\t\tentirely. Alternately, an email address such as\n\t\t\"address@example.com\" could be translated to\n\t\t\"adres@przyklad.com\". If an attacker can control the\n\t\tdomain or email address that is generated by the\n\t\ttranslation, then the attacker might be able to spoof\n\t\tcommunications with the product's users.", "#text_blocks": ["If the translation is from English to Polish,\n\t\tthen \"example.com\" might be translated to\n\t\t\"przyklad.com\" - a different web site\n\t\tentirely. Alternately, an email address such as\n\t\t\"address@example.com\" could be translated to\n\t\t\"adres@przyklad.com\". If an attacker can control the\n\t\tdomain or email address that is generated by the\n\t\ttranslation, then the attacker might be able to spoof\n\t\tcommunications with the product's users."]}}}, "Observed_Examples": {"Observed_Example": [{"Reference": "CVE-2022-48279", "Description": "Web Application Firewall (WAF) does not\n\t      parse HTTP multipart requests correctly, allowing\n\t      bypass.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-48279"}, {"Reference": "CVE-2022-24723", "Description": "JavaScript URL library does not correctly\n\t      parse URLs with leading whitespace.", "Link": "https://www.cve.org/CVERecord?id=CVE-2022-24723"}]}, "Mapping_Notes": {"Usage": "Allowed-with-Review", "Rationale": "This CWE Entry is a Class and might have lower-level children that would be more appropriate", "Comments": "Examine children of this entry to see if there is a better fit", "Reasons": {"Reason": {"@Type": "Abstraction"}}}, "Notes": {"Note": {"@Type": "Maintenance", "@Version": "5.0", "@ReleaseDate": "2026-10-28", "#text": "This entry was created in CWE 5.0 to address known gaps in CWE coverage. It is not as complete as other new entries that were published in recent years. The CWE Team plans to work with the CWE community to make this entry more complete in later 5.x releases."}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2026-10-24", "Submission_Version": "5.0", "Submission_ReleaseDate": "2026-10-28"}, "Contribution": {"@Type": "Content", "Contribution_Name": "Michal Biesiada", "Contribution_Date": "2023-04-11", "Contribution_Version": "5.0", "Contribution_ReleaseDate": "2026-10-28", "Contribution_Comment": "Suggested inclusion of\n\t\t  erroneous language translation of e-mail addresses,\n\t\t  leading to a demonstrative\n\t\t  example."}}, "entry_type": "Weakness"}