3 ms·
As this vulnerability exploits weird charset, is is possible to just whitelist the encodings system-wide ? Ideally all charset libraries should reject charsets
by dolmen 2y ago
As this vulnerability exploits weird charset, is is possible to just whitelist the encodings system-wide ? Ideally all charset libraries should reject charsets out of that list.
There are so many implementations of charset conversions (each programming language has one or many implementations) and so many document format that allow to trigger them. If I write an internal backoffice application I should be able to constrain that any use of an exotic charset is suspect and should be blocked.