Hacker News new | ask | show | jobs
by motti 3896 days ago
This sort of stuff can be the basis for many XSS attacks, see http://websec.github.io/unicode-security-guide/character-tra...

For instance, \u2329, \uFE64, \uFF1C and \u3008 can be best-fitted automatically to \u003C (the regular '<' mark in HTML)

1 comments

It is also good tool to check is Unicode supported well: just convert all user visible messages and then check interface of the program for <?> or [].