Re:Plain Text Doesn’t Exist: Unicode and encodings demystified
by millstone on Monday August 26, 2013 @01:04PM
(#6278275)
It can allow for security exploits, if the different layers of your stack handle invalid code units differently.
There's a related issue with "non-shortest forms:" it's possible to encode the NUL character '\0' without actually using a null byte. This means that (for example) "round tripping" UTF-8 data can introduce a null byte, allowing for security exploits when mixed with C-style string processing.
There's a related issue with "non-shortest forms:" it's possible to encode the NUL character '\0' without actually using a null byte. This means that (for example) "round tripping" UTF-8 data can introduce a null byte, allowing for security exploits when mixed with C-style string processing.