-
Notifications
You must be signed in to change notification settings - Fork 16
/
Copy pathnormalization_security.theory.txt
19 lines (17 loc) · 1.29 KB
/
normalization_security.theory.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
┏━━━━━━━━━━━━━━━━━━━━━━━━━━━━┓
┃ NORMALIZATION_SECURITY ┃
┗━━━━━━━━━━━━━━━━━━━━━━━━━━━━┛
NORMALIZATION ==> #When a VAL has multiple equivalent variants
#This can lead to comparison logic to fail
#This can also be used to confuse, e.g. for phishing
#Examples:
# - transtyping
# - encoding, including charset
# - STR: case, Unicode normalization
# - NUM: radix, FLOAT representation, decimal digits, epsilon, i18n (e.g. separators)
# - OBJ: keys order
# - ARR: order
# - base64: padding, chars outside charset, newlines
# - paths: symlinks
# - path/URIs: . .., relative links, duplicate /
# - URIs: default parts, unused parts