Collaborate Disseminate
An innocent-looking message, containing characters in the Sindhi language, can cause your iPhone to crash without warning.
Read more in my article on the Hot for Security blog.
Continue reading Text ‘bomb’ crashes iPhones, iPads, Macs and Apple Watches – what you need to know
Are there any character encoding mixup attacks that are still a threat in 2020? Such as with XSS or SQL injection being the most obvious.
Some examples:
Tricking a browser to display a page in UTF-7 despite XSS filtering was done in UT… Continue reading XSS / SQL Injection Attacks with Character Encoding Mixups
I once encountered a very interesting type of XSS on a website purely by accident. This website allows users to upload PDFs, and will open the PDF in browser with some builtin Javascript. What happened was I uploaded a paper of mine that c… Continue reading PDF fonts, encodings, and risk potentials interacting with web browser
Say we have a server-side code does a whitelist validation of allowed file extensions when user uploads a file:
// Java code
if (allowedExtensionsInLowercase.contains(fileExtension.toLowerCase())) {
// File allowed
} else {
// Booh, bad… Continue reading Is there a list of Unicode symbols that matches ASCII when lowercased (in java)?
Unicode, the wonderful extension to to ASCII that gives us gems like “✈”, “⌨”, and “☕”, has had some unexpected security ramifications. The most common problems with Unicode are visual security issues, like character confusion between letters. For example, the English “M” (U+004D) is indistinguishable from the Cyrillic “М” (U+041C). …read more
Continue reading This Week in Security: Unicode, Truecrypt, and NPM Vulnerabilities
I’ve got two byte sequences, and I decode them as UTF-8 (in strict mode to be sure they’re valid UTF-8).
Is it correct to assume that, if the bytes are different, the decoded codepoints will also be different?
In other word… Continue reading Is UTF-8 malleable?
I receive a lot of spam email (probably from recent breaches). A lot of them contain text that looks a lot like the below text:
Why do they contain such weird characters? Is this part of an exploit? Is this to mislead spam filters? Or i… Continue reading Why do so many spam emails lately contain a lot of unicode characters?
I’m reading a report on HackerOne https://hackerone.com/reports/52042.
An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line).
The %E5%98%8A sequence corresponds to U+560A Unicode… Continue reading Encoding ASCII character as three-byte UTF-8. How does it work?
I’m maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At one point, the applicatio… Continue reading Is it risky to URL-encode characters in an already URL-encoded string?
Pretext
I’m in the middle of deploying Apache Solr as a search backend. Solr is using its own query language, for an example:
search(s2, q=author:”user_str”, fl=”id,title,authors”, sort=”id asc”, qt=/export)
There, user_s… Continue reading Input sanitization: Pitfalls in rolling your own – securing DSLs