|Main Archive Page > Month Archives > full-disclosure-uk archives|
On 5/21/07, Łukasz Pilorz <firstname.lastname@example.org> wrote:
> I think this encoding bypass may have some impact on applications
> which convert data from Unicode/UTF to other encodings. A naive
> But I don't suggest this was the main problem, I have probably missed
> something too.
Your POC works for me, the PHP iconv code converts the UTF-8 byte sequence 0xef 0xbc 0x9C to ASCII '<'. Looks like PHP applications may be at risk.
The java CharsetDecoder class does not. (I don't think this will be JRE specific, but I tested the IBM JRE...).
The perl Encode module does not.
Anybody have an IIS server handy, to test out how .NET handles this?