Improper Handling of Unicode Encoding
The product does not properly handle when an input contains Unicode encoding.
Unicode characters can have multiple encodings or representations. If an application does not properly handle Unicode, attackers may be able to bypass security filters or cause unexpected behavior using alternate encodings.
So behebst du diese Schwachstelle
Präventionsstrategien für Improper Handling of Unicode basierend auf 3 Shoulder-Erkennungsregeln.
Normalize strings with NFKC before security-sensitive comparisons
- func handler(w http.ResponseWriter, r *http.Request) { - username := r.FormValue("username") - if username == "admin" { + import "golang.org/x/text/unicode/norm" + + func handler(w http.ResponseWriter, r *http.Request) { + username := r.FormValue("username") + normalized := norm.NFKC.String(strings.ToLower(username)) + if normalized == "admin" { grantAdminAccess() } }
Normalize Unicode strings with NFKC before security-sensitive comparisons
app.post('/login', (req, res) => { - if (req.body.username === 'admin') { + const username = req.body.username.normalize('NFKC').toLowerCase(); + if (username === 'admin') { return res.send('Admin access'); } });
Normalize Unicode strings with NFKC before comparison or security-critical operations
- def check_username(input_name, stored_name): - if input_name == stored_name: + import unicodedata + + def check_username(input_name, stored_name): + normalized_input = unicodedata.normalize('NFKC', input_name).lower() + normalized_stored = unicodedata.normalize('NFKC', stored_name).lower() + if normalized_input == normalized_stored: grant_access()
Finden Sie Schwachstellen in Ihrem Code
Verwenden Sie Shoulder, um Ihren Code nach Improper Handling of Unicode Encoding-Mustern zu scannen. 3 Regeln.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=176 # Or scan entire project npx @shoulderdev/cli trust .
Erkennungsregeln (3)
Worauf bei Code-Reviews zu achten ist
Diese Muster weisen auf potenzielle Improper Handling of Unicode Encoding-Schwachstellen hin. Achten Sie bei Code-Reviews und Sicherheitsaudits darauf.
Scanne deine Codebasis nach Improper Handling of Unicode Encoding
Shoulder CLI findet anfällige Muster in deiner gesamten Codebasis.