Page History

...

ISO/IEC TR 24772:2013	Cross-site Scripting [XYT]
MITRE CWE	CWE-289, Authentication bypass by alternate name CWE-180, Incorrect behavior order: Validate before canonicalize

Android Implmentation Details

Android apps can receive string data from the outside and normalize it.

[API 2006]	Java Platform, Standard Edition 6 API Specification
[Davis 2008]
[Weber 2009]	Exploiting Unicode-enabled Software

...