Improper Handling of Unicode Encoding
The product does not properly handle when an input contains Unicode encoding.
Unicode characters can have multiple encodings or representations. If an application does not properly handle Unicode, attackers may be able to bypass security filters or cause unexpected behavior using alternate encodings.
How to fix this vulnerability
Prevention strategies for Improper Handling of Unicode based on 3 Shoulder detection rules.
Normalize strings with NFKC before security-sensitive comparisons
- func handler(w http.ResponseWriter, r *http.Request) { - username := r.FormValue("username") - if username == "admin" { + import "golang.org/x/text/unicode/norm" + + func handler(w http.ResponseWriter, r *http.Request) { + username := r.FormValue("username") + normalized := norm.NFKC.String(strings.ToLower(username)) + if normalized == "admin" { grantAdminAccess() } }
Normalize Unicode strings with NFKC before security-sensitive comparisons
app.post('/login', (req, res) => { - if (req.body.username === 'admin') { + const username = req.body.username.normalize('NFKC').toLowerCase(); + if (username === 'admin') { return res.send('Admin access'); } });
Normalize Unicode strings with NFKC before comparison or security-critical operations
- def check_username(input_name, stored_name): - if input_name == stored_name: + import unicodedata + + def check_username(input_name, stored_name): + normalized_input = unicodedata.normalize('NFKC', input_name).lower() + normalized_stored = unicodedata.normalize('NFKC', stored_name).lower() + if normalized_input == normalized_stored: grant_access()
Find vulnerabilities in your code
Use Shoulder to scan your codebase for Improper Handling of Unicode Encoding patterns. 3 rules.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=176 # Or scan entire project npx @shoulderdev/cli trust .
Detection Rules (3)
What to watch for in code reviews
These patterns indicate potential Improper Handling of Unicode Encoding vulnerabilities. Look for these during code reviews and security audits.
Scan your codebase for Improper Handling of Unicode Encoding
Shoulder CLI finds vulnerable patterns across your entire codebase.