Skip to content

pySCG 707 180 2 GitHub #846

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Conversation

myteron
Copy link
Contributor

@myteron myteron commented Apr 3, 2025

adding #180 as per #531

myteron added 3 commits April 3, 2025 13:06
Signed-off-by: Helge Wehder <[email protected]>
Signed-off-by: Helge Wehder <[email protected]>
@andrew-costello
Copy link
Contributor

Reviewing this.

Copy link
Contributor

@andrew-costello andrew-costello left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Everything looks good to me, +1.

@s19110
Copy link
Contributor

s19110 commented Apr 10, 2025

Also reviewing this.

Copy link
Contributor

@s19110 s19110 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I left a few minor change suggestions.

myteron and others added 2 commits April 17, 2025 10:55
Copy link
Contributor

@s19110 s19110 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Found one uppercase in Unicode. Other than that, the rule looks good to me.


The first two lines in `example01.py` return `False` due to the missing compatibility mode and the last two lines return `True`. The issue depends on whether normalization is used, its mode, and when it is applied.

Using a compatibility mode `NFKC` and `NFKD` can allow attackers to disguise malicious strings by using characters that are beyond the `ASCII` range of `0-127` turning a `ONE DOT LEADER` `\u2024` into a `FULL STOP \u002E`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Caught an uppercase!

Suggested change
Using a compatibility mode `NFKC` and `NFKD` can allow attackers to disguise malicious strings by using characters that are beyond the `ASCII` range of `0-127` turning a `ONE DOT LEADER` `\u2024` into a `FULL STOP \u002E`.
Using a compatibility mode `NFKC` and `NFKD` can allow attackers to disguise malicious strings by using characters that are beyond the `ASCII` range of `0-127` turning a `ONE DOT LEADER` `\u2024` into a `FULL STOP \u002e`.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants