thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Canonicalization

Converting data to its standard, simplest form before validating or using it.

Definition

Inputs can have multiple encodings (URL encoding, double encoding, Unicode variants, alternate path separators) that bypass validation if checks occur before decoding. Canonicalize first, then validate, and do not decode again afterwards.

Example

A path containing %2e%2e%2f is decoded to ../ before the path check runs.

Exam tip

Order matters: canonicalize, then validate. Double decoding is a common bypass.

Related terms