Unicode: The hero or villain?
Talkat OWASP AppSec Europe 2018 · on Thursday, 2018-07-05· at 10:15· St James - 4th Floor, QEII Centre Broad Sanctuary, Westminster·
summary
Claims that Unicode need not wreck validation and shows concrete fixes: use Unicode data in Python to inspect categories and scripts, apply NFC normalization (not NFKC for persistence), enforce character-category, script and text-direction policies, decode input strictly (or reject) and log malformed UTF‑8, and prefer UTF‑8 with explicit BOM handling. Examples include an encoding‑converter C utility and a Web cookies orc research site; numbers on encodings and attacks come from real debugging and CVE‑style decoder failures.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 3:46Unicode research focus
- 8:08Pre-Unicode chaos
- 13:11Characters vs bytes
- 19:56Homoglyphs basics
- 26:14Security validation
- 33:34Business rules
- 36:35Q&A
