TRB-111v1.0.0 · urlencoded_multiple_layers
URL-encoded multiple layers
URL-encoded multiple layers identifies different consumers can interpret duplicate, normalized, or trailing input differently.
CWE mapping
CWE-436parser differential
Assurance
The analyzer verified the reported construct is present in the supplied input.
Conditional: Impact depends on how the destination parser, runtime, or deployment is configured.
Inert example
Displayed as text only. tryb does not execute this example.
role=reader&role=adminRemediation
inspect-context. The observed property needs destination-specific policy before an automatic rewrite is safe.
Verify: Inspect the actual consumer and encode the intended acceptance rule in a test.
What to verify next
Confirm the exact production parser and security settings before treating this as exploitable.