4 ms·
This sort of stuff can be the basis for many XSS attacks, see http://websec.github.io/unicode-security-guide/character-transformations/ http://websec.github.io/
by motti 11y ago
This sort of stuff can be the basis for many XSS attacks, see http://websec.github.io/unicode-security-guide/character-transformations/ http://websec.github.io/unicode-security-guide/character-tra...
For instance, \u2329, \uFE64, \uFF1C and \u3008 can be best-fitted automatically to \u003C (the regular '<' mark in HTML)
- lisivka 11y agoIt is also good tool to check is Unicode supported well: just convert all user visible messages and then check interface of the program for <?> or [].