<story><title>How can you be fooled by the U+202E trick? (2013)</title><url>https://galogetlatorre.blogspot.com/2013/07/how-can-you-be-fooled-by-u202e-trick.html</url></story><parent_chain></parent_chain><comment><author>klabb3</author><text>With most attack vectors, like buffer overflows, csrf, SQL injection, I (and many developers that aren&amp;#x27;t security domain experts) am acutely aware of best practices and mitigations. I know exactly where they can appear and how to prevent them. (Well not literally but it&amp;#x27;s a simple web search away).&lt;p&gt;With unicode, I really don&amp;#x27;t know what to do. What strings need to be sanitized (or validated)? File names? Urls? How do I sanitize them without causing agony for most of the world? Are there other unicode attack vectors?</text></comment>
<story><title>How can you be fooled by the U+202E trick? (2013)</title><url>https://galogetlatorre.blogspot.com/2013/07/how-can-you-be-fooled-by-u202e-trick.html</url></story><parent_chain></parent_chain><comment><author>Waterluvian</author><text>Please correct me if I’m overreacting but I feel like Unicode in most cases is just a giant security flaw and the only reason we tolerate it is because it does tremendous good making things more equitable for other languages and cultures.&lt;p&gt;Unicode in URLs and usernames and filenames is just so easy to trick people with.&lt;p&gt;Will there be Unicode email addresses?</text></comment>