D 2017-05-31T11:44:32.706
J assignee nobody
J closer nobody
J cmimetype text/x-fossil-wiki
J comment Example:\r\n<pre>\r\n\s\s\sencoding\sconvertfrom\sutf-8\s\\x3c\\xc0\\xbc\r\n\s\s\s<<\r\n</pre>\r\nSo,\sthe\sbyte\ssequence\s\\xc0\\xbc\sproduces\sthe\ssame\scharacter\sas\s\\x3c.\sThis\sis\sknow\sas\soverly\slong\sUTF=8\ssequences,\sand\sit\sis\sdangerous.\sFor\sexample,\sa\sHTML\sfile\scan\sbe\sconstructed\scontaining\sthe\ssequence\s"\\xc0\\xbcscript\s...".\sWhen\sTcl\sreads\sthis\sfile\sand\soutputs\sit\sagain\sin\sUTF-8,\sthe\ssequence\sbecomes\s"<script\s...",\swhich\scan\sactually\srun\ssomething!\r\n\r\nMost\sUTF-8\sdecoders\shandle\sthis\sthe\ssame\sas\sother\sinvalid\sUTF-8\ssequences:\sJust\soutput\svalid\sUTF-8\scorresponding\swith\sthe\sindividual\sbytes.\sThe\soriginal\sexample\sthen\sbecomes:\r\n<pre>\r\n\s\s\sencoding\sconvertfrom\sutf-8\s\\x3c\\xc0\\xbc\r\n\s\s\s<À¼\r\n</pre>\r\n\r\nThe\scharacters\s"À¼"\sare\s'safe'\sin\sHTML,\ssince\sno\scharacters\s>\s\\x7f\shave\sa\sspecial\smeaning.
J foundin 8.6
J is_private 0
J login jan.nijtmans
J priority 5\sMedium
J resolution None
J severity Important
J status Open
J submitter jan.nijtmans
J subsystem 44.\sUTF-8\sStrings
J title Security:\sInvalid\sUTF-8\scan\sinject\sunexpected\scharacters
J type Bug
K 67aa9a207037ae67f9014b544c3db34fa732f2dc
U jan.nijtmans
Z 529ee450c28f35b08a0e7814c41bbd96