News for hackers. Stuff that matters.

A comment on The Absolute Minimum Every Software Developer Must Know About Unicode in 2023. Parent comment

Re:The Absolute Minimum Every Software Developer Must Know A... by nwellnhof on Monday October 02, 2023 @09:33AM (#37737863)
It's unnecessary complexity and a security nightmare. Have you ever tried to implement Unicode normalization? A single bug in your code and malformed text can crash your application or worse.
[ Parent | on HN ]
Re:The Absolute Minimum Every Software Developer Must Know A... by torstenvl on Monday October 02, 2023 @09:40AM (#37737955)
[delayed]
[ Parent | on HN ]
Re:The Absolute Minimum Every Software Developer Must Know A... by hot_gril on Monday October 02, 2023 @12:07PM (#37740023)
iMessage has had several vulnerabilities related to this. Whatever the difficulties are, even Apple can't handle them sometimes.
[ Parent | on HN ]
Re:The Absolute Minimum Every Software Developer Must Know A... by torstenvl on Monday October 02, 2023 @01:36PM (#37741630)
I'm very skeptical, but willing to be proven wrong. What's the CVE?
[ Parent | on HN ]
Re:The Absolute Minimum Every Software Developer Must Know A... by hot_gril on Monday October 02, 2023 @01:46PM (#37741788)
First that comes to mind is the "effective power" one, https://nvd.nist.gov/vuln/detail/cve-2015-1157 There's also the "black dot" one, can't find the CVE though.
[ Parent | on HN ]
Re:The Absolute Minimum Every Software Developer Must Know A... by torstenvl on Monday October 02, 2023 @02:30PM (#37742421)
That seems like a truncation + display issue though, not a normalization issue.

https://www.reddit.com/r/apple/comments/37e8c1/malicious_tex...

[ Parent | on HN ]
Re:The Absolute Minimum Every Software Developer Must Know A... by dleeftink on Monday October 02, 2023 @09:59AM (#37738226)
That's tricky, for sure. My 'workaround' has long been converting codepoints into byte sequences and creating a character dictionary from that. Based on the source corpus, this dictionary can be further expanded/compressed and used for downstream processing.
[ Parent | on HN ]