Friday, May 08, 2009
Spoofing characters
You wouldn't think there's a security issue in the UTF-8 character set, but there is, in an indirect way. In a note on a Sun Java blog, it's explained that in the old (20th century) definition of UTF-8, some characters could be represented by more than one byte sequence. For example, any ASCII character (0X01 through 0X7F) could be preceded by 0XC0 without changing its interpretation. This could create problems if security filters are looking for certain characters in order to stop cross-site scripting or SQL injection; the spoofed characters could get past such filters if they don't take the alternate byte representations into account. For this reason, the current UTF-8 requirements specify that the shortest byte representation of a character is the only legitimate one.
This change was made in 2000, but not all implementations of UTF-8 have caught up. Sun has only recently fixed this in Java, with JDK7, Open JDK 6, JDK 6 update 11 and later, JDK5.0u17, and Java 1.4.2_19. (If you're using Java 1.3 or earlier, you're probably stuck, but why would you do that?)
