Improper Handling of Extra Parameters
The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same name exceeds the expected amount.
When applications receive duplicate parameters, they may process them inconsistently, leading to security bypasses or logic errors. Different frameworks may select the first, last, or combine duplicate parameters.
How to fix this vulnerability
Prevention strategies for Improper Handling of Extra Parameters based on 2 Shoulder detection rules.
Add hpp middleware to normalize duplicate query parameters
+ const hpp = require('hpp'); + app.use(hpp()); + app.get('/search', (req, res) => { const role = req.query.role; if (role === 'admin') { res.json({ admin: true }); } });
Explicitly check for and reject duplicate HTTP parameters
- from flask import request - - @app.route('/api/action') - def action(): - user_id = request.args.get('id') - # Attacker sends: ?id=1&id=admin - # Only gets first value, but backend proxy may use last + from flask import request, jsonify + + @app.route('/api/action') + def action(): + all_ids = request.args.getlist('id') + if len(all_ids) != 1: + return jsonify({'error': 'Duplicate parameters not allowed'}), 400 + user_id = all_ids[0] perform_action(user_id)
Find vulnerabilities in your code
Use Shoulder to scan your codebase for Improper Handling of Extra Parameters patterns. 2 rules.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=235 # Or scan entire project npx @shoulderdev/cli trust .
Detection Rules (2)
What to watch for in code reviews
These patterns indicate potential Improper Handling of Extra Parameters vulnerabilities. Look for these during code reviews and security audits.
Scan your codebase for Improper Handling of Extra Parameters
Shoulder CLI finds vulnerable patterns across your entire codebase.