3 ms·
For security reasons, the correct answer on how process invalid UTF-8 is (and needs to be) "throw away the data like it's radioactive, and return an error." Oth
by ekidd 1y ago
For security reasons, the correct answer on how process invalid UTF-8 is (and needs to be) "throw away the data like it's radioactive, and return an error." Otherwise you leave yourself wide open to validation bypass attacks at many layers of your stack.
- modeless 1y agoThis is only true because the interpretation is not defined, so different implementations do different things.
- cryptonector 1y agoThat's not true. You're just not allowed to interpret them as characters.
- account42 1y agoThis is rarely the correct thing to do. Users don't particularly like it if you refuse to process a document because it has an error somewhere in there. Even for identifiers you probably want to do all kinds of normalization even beyond the level of UTF-8 so things like overlong sequences and other errors are really not an inherent security issue.