Skip to content

Commit 09c97ce

Browse files
committed
Added one more example to the qhelp
1 parent 7d68f6a commit 09c97ce

File tree

2 files changed

+14
-0
lines changed

2 files changed

+14
-0
lines changed

ruby/ql/src/experimental/cwe-176/UnicodeBypassValidation.qhelp

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,18 @@
2323

2424
<sample src="./examples/unicode_normalization.rb" />
2525

26+
</example>
27+
<example>
28+
29+
<p> The next example shows how an early deletion of a character may be bypassed due to a
30+
potential Unicode character collision.</p>
31+
<p>The character <code>&lt;</code> was expected to be omitted from the string <code>s</code>.
32+
However, a malicious user may consider using its colliding Unicode character U+FE64 <code>
33+
﹤</code> as an alternative. Due to the Late-Unicode normalization with the form NFKC,
34+
the resulting string would contain the unintended character <code>&lt;</code> . </p>
35+
36+
<sample src="./examples/unicode_normalization2.rb" />
37+
2638
</example>
2739
<references>
2840
<li> Research study: <a
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
s = "﹤xss>"
2+
puts s.delete("<").unicode_normalize(:nfkc).include?("<")

0 commit comments

Comments
 (0)