The unicode tag has no wiki summary.
6
votes
3answers
326 views
Is there a way to bypass Django's XSS escaping with “unicode”?
Django (the Python web framework) escapes output to prevent XSS (Cross Site Scripting) attacks. It replaces ', ", <, >, & with their HTML safe versions.
However this presentation on slide ...
6
votes
1answer
218 views
White list or black list sanitation for international input?
There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option.
For instance, one can fairly easily craft a white list ...
5
votes
2answers
208 views
What applications are at risk from “Backwards Unicode Names” and what are the mitigations?
There is a vulnerability where some applications (such as explorer.exe) respond to Unicode characters that change the direction of the text (right-to-left vs left-to-right). This may be used to mask ...
4
votes
2answers
209 views
What exploit types do I need to protect against in PHP?
I recently learned that apparently, it is common for people to attempt SQL injections using the HTTP referrer in PHP. What other inputs do I need to protect against? I am currently "cleaning up" ...
3
votes
2answers
98 views
Is there a dictionary of visibly similar Unicode characters for Spam processing?
I have spam that looks like this:
мy вυddy'ѕ мoм мαĸeѕ $74/нoυr oɴ тнe lαpтop. ѕнe нαѕ вeeɴ lαιd oғғ ғor
ѕeveɴ мoɴтнѕ вυт lαѕт мoɴтн нer pαy cнecĸ wαѕ $19420 jυѕт worĸιɴɢ oɴ
тнe lαpтop ғor α ...
3
votes
2answers
168 views
How to defend against invalid UTF7/8 that hides a <script> tag?
I'm scanning HTML before it reaches a browser, and I've just heard about a type of exploit that uses invalid UTF7 or UTF8 sequences to embed an otherwise invisible script tag, which is used to execute ...
2
votes
1answer
119 views
XSS via Unicode
Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that:
[…] support for Unicode character ...
