UnicodeBypassValidation.qhelp

<!DOCTYPE qhelp PUBLIC "-//Semmle//qhelp//EN" "qhelp.dtd">
<qhelp>
    <overview>
        <p>Security checks bypass due to a Unicode transformation</p>
        <p>
            If ever a unicode tranformation is performed after some security checks or logical
            validation, the
            latter could be bypassed due to a potential Unicode characters collision.
            The validation of concern are any character escaping, any regex validation or any string
            verification.
        </p>
        <img src="./vulnerability-flow.png" alt="Security checks bypassed" />
    </overview>
    <recommendation>
        <p> Perform a Unicode normalization before the logical validation. </p>
    </recommendation>
    <example>

        <p> The following example showcases the bypass of all checks performed by <code>
            flask.escape()</code> due to a post-unicode normalization.</p>
        <p>For instance: the character U+FE64 (<code>﹤</code>) is not filtered-out by the flask
            escape function. But due to the Unicode normalization, the character is transformed and
            would become U+003C (<code> &lt; </code> ).</p>

        <sample src="escape-bypass.py" />

    </example>
    <references>
        <li> Research study: <a
                href="https://gosecure.github.io/presentations/2021-02-unicode-owasp-toronto/philippe_arteau_owasp_unicode_v4.pdf">
            Unicode vulnerabilities that could bYte you
            </a> and <a
                href="https://gosecure.github.io/unicode-pentester-cheatsheet/">Unicode pentest
            cheatsheet</a>. </li>
    </references>
</qhelp>