Page History

...

For example, an application's strategy for avoiding cross-site scripting (XSS) vulnerabilities may include forbidding <script> tags in inputs. Such blacklisting mechanisms are a useful part of a security strategy, even though they are insufficient for complete input validation and sanitization. When implemented, this form of validation must be performed only after normalizing the input.

Wiki MarkupCharacter information in Java SE 6 is based on the Unicode Standard, version 4.0 \ [[Unicode 2003|AA. References#Unicode 2003]\]. Character information in Java SE 7 is based on the Unicode Standard, version 6.0.0 \[ [Unicode 2011|AA. References#Unicode 2011]\].unmigrated-wiki-markup

According to the Unicode Standard \ [[Davis 2008|AA. References#Davis 08]\], annex #15, Unicode Normalization Forms:

When implementations keep strings in a normalized form, they can be assured that equivalent strings have a unique binary representation.

Normalization Forms KC and KD must not be blindly applied to arbitrary text. Because they erase many formatting distinctions, they will prevent round-trip conversion to and from many legacy character sets, and unless supplanted by formatting markup, they may remove distinctions that are important to the semantics of the text. It is best to think of these Normalization Forms as being like uppercase or lowercase mappings: useful in certain contexts for identifying core meanings, but also performing modifications to the text that may not always be appropriate. They can be applied more freely to domains with restricted character sets.

...

Related Guidelines

...

[ISO/IEC TR 24772:2010	http://www.aitcnet.org/isai/]	Cross-site scripting [XYT] ] ]></ac:plain-text-body></ac:structured-macro>
MITRE CWE	CWE-289. Authentication bypass by alternate name
	CWE-180. Incorrect behavior order: Validate before canonicalize

Bibliography

...

IDS00-J. Sanitize untrusted data passed across a trust boundary