Re:Smuggling arbitrary data through an emoji
by capitainenemo on Wednesday February 12, 2025 @07:49PM
(#43031504)
Yeah. Zalgo text is a common test for input fields on websites. But it usually doesn't do anything interesting. Maybe an exception trigger on some database length limit. Doesn't typically even kill any processes. The exception is normally just in your thread. You can often trigger it just by disabling JS on even modern forms, but,, at best you're maybe leaking a bit of info if they left debug on and print the stack trace or a query.
Another common slip-up is failing to count \n vs \r\n in text strings since JS usually usually counts a carriage return as 1 byte, but HTTP spec requires two.
unescape(encodeURIComponent("รง")).length is the quick and dirty way to do a JS byte length check. The \r\n thing can be done just by cleaning up the string before length counting.
Re:Smuggling arbitrary data through an emoji
by Rendello on Thursday February 13, 2025 @07:39PM
(#43043296)
A few months ago I made a post which I (should've) named "Unicode codepoints that expand or contract when case is changed in UTF-8". A decent parser shouldn't have any issues with things like this, but software that makes bad Unicode assumptions might.
Re:Smuggling arbitrary data through an emoji
by dotancohen on Friday February 14, 2025 @06:13PM
(#43054088)
Does Zalgo even work on HN? I've never thought of using it to test my systems, thank you. I've got some new testing to do tonight.
Edit: No, Zalgo doesn't work on HN. This comment itself was an experiment to try.
I remember doing penetration testing waaaaaay back in the day (before Python 3 existed) and using mere diacritics to turn a single character into many bytes that would then overflow the buffer of a back-end web server. This only ever caused it to crash (and usually auto-restart) but I could definitely see how this could be used to exploit certain systems/software with enough fiddling.