3 ms·

It's unnecessary complexity and a security nightmare. Have you ever tried to implement Unicode normalization? A single bug in your code and malformed text can c

It's unnecessary complexity and a security nightmare. Have you ever tried to implement Unicode normalization? A single bug in your code and malformed text can crash your application or worse.

torstenvl 3y ago
It's hard for me to imagine how Unicode normalization could crash your application unless you have very convoluted memory management code. What on earth are you doing that it's leading to crashes? Are you not validating the result?
- hot_gril 3y ago
  iMessage has had several vulnerabilities related to this. Whatever the difficulties are, even Apple can't handle them sometimes.
  - torstenvl 3y ago
    I'm very skeptical, but willing to be proven wrong. What's the CVE?
    - hot_gril 3y ago
      First that comes to mind is the "effective power" one, https://nvd.nist.gov/vuln/detail/cve-2015-1157 https://nvd.nist.gov/vuln/detail/cve-2015-1157 There's also the "black dot" one, can't find the CVE though.
      - torstenvl 3y ago
        That seems like a truncation + display issue though, not a normalization issue. https://www.reddit.com/r/apple/comments/37e8c1/malicious_text_message/ https://www.reddit.com/r/apple/comments/37e8c1/malicious_tex... In fact, I don't know that there's any reason to believe normalization happens at all in the process of executing this.
dleeftink 3y ago
That's tricky, for sure. My 'workaround' has long been converting codepoints into byte sequences and creating a character dictionary from that. Based on the source corpus, this dictionary can be further expanded/compressed and used for downstream processing.