Canonicalization

Normalize Security-Sensitive Input Before Making Decisions

Security checks often compare names, paths, identifiers, hosts, or other values against a rule. The rule may be correct and the comparison may look correct, yet the system can still make the wrong decision if different components interpret the same input differently. For example, one layer may treat two textual forms as equivalent while another treats them as different. A validator can approve one representation, then a later component can normalize or decode it into a different value before using it. The security check and the operation are no longer reasoning about the same thing.