6 ms·
I'm not following your scenario here. How would a font be able to create these fragments at all? I can imagine a font rendering a glyph as a line of code. But
by function_seven 4y ago
I'm not following your scenario here. How would a font be able to create these fragments at all?
I can imagine a font rendering a glyph as a line of code. But under the hood it would still be just a byte or bytes corresponding to that codepoint.
- chrsstrm 4y agoI’m not sure, but I suppose you would be correct.
- mFixman 4y agoYou just need a program that registers the `'; DROP TABLE 'users` font and voilá.
- tobyjsullivan 4y agoI don't think this is what OP was talking about but fonts are Turing-complete and can introduce all manner of exploits.[0] However, getting the font installed seems like the hard bit - I don't see how loading it or detecting it in a website makes anything new possible. [0] https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/microsoft-alerts-users-about-critical-font-related-remote-code-execution-vulnerability-in-windows https://www.trendmicro.com/vinfo/us/security/news/vulnerabil...
- snapcaster 4y agoSeems like everything is turing complete these days. Good share, didn't know any of this stuff