4 ms·
Using specialized types can be useful, but if it provide s methods they need to be correct for ALL situations. Here's a subversion of GitHub's authentication (
by dwheeler 4y ago
Using specialized types can be useful, but if it provide s methods they need to be correct for ALL situations.
Here's a subversion of GitHub's authentication (now fixed) where they assumed that "lowercasing domain name using English case rules is always fine and produces the same result" led to a vulnerability:
https://dev.to/jagracey/hacking-github-s-auth-with-unicode-s-turkish-dotless-i-460n https://dev.to/jagracey/hacking-github-s-auth-with-unicode-s...
- afiori 4y agoTIL that punycode breaks email.split('@') to get the domain: Apparently John@Gıthub.com normalizes to xn--john@gthub-2ub.com but Gıthub.com normalizes to xn--gthub-n4a.com. For now I will go back to forgetting that emails not covered by /[A-Za-z0-9.-+_]+@[A-Za-z0-9.-_](.[A-Za-z0-9.-_])*/ exist to preserve my sanity but this does confuse me.