3 ms·
Where are these characters stripped out? I can see that these create security issues with urls that get rendered with changed field order to look benign.
by gmueckl 7y ago
Where are these characters stripped out? I can see that these create security issues with urls that get rendered with changed field order to look benign.
- yyyk 7y agoI meant stripped from the mail body - though I suspect these programs would also strip them out of the other fields (I haven't checked that). In general, working with zero-width characters is a bad idea from both security and usability POV and is not a practical solution. The result is that the only reasonable and compatible way to mix LTR (left-to-right, like English) and RTL (right-to-left, as with ME languages) is with HTML email. Note that in most cases rendering is an LTR context, so even sending RTL on its own will fare poorly.