Page History

import java.text.Normalizer;
import java.text.Normalizer.Form;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
 
public class TagFilter {
  public static String filterString(String str) {
    String s = Normalizer.normalize(str, Form.NFKC);

    // Validate input
    

In some versions prior to Unicode 5.2, conformance clause C7 allows the deletion of noncharacter code points.  For example, conformance clause C7 from Unicode 5.1 states \[[Unicode 2007|AA. References#Unicode 2007]\]:

{quote}
C7. When a process purports not to modify the interpretation of a valid coded character sequence, it shall make no change to that coded character sequence other than the possible replacement of character sequences by their canonical-equivalent sequences or the deletion of noncharacter code points.
{quote}

According to the Unicode Technical Report #36, Unicode Security Considerations \[[Davis 2008b|AA. References#Davis 08b]\], Section 3.5, "Deletion of Noncharacters": 

{quote}
Whenever a character is invisibly deleted (instead of replaced), such as in this older version of C7, it may cause a security problem. The issue is the following: A gateway might be checking for a sensitive sequence of characters, say "delete". If what is passed in is "deXlete", where X is a noncharacter, the gateway lets it through: the sequence "deXlete" may be in and of itself harmless. However, suppose that later on, past the gateway, an internal process invisibly deletes the X. In that case, the sensitive sequence of characters is formed, and can lead to a security breach.
{quote}

Any string modifications, including the removal or replacement of noncharacter code points, must be performed before any validation of the string is performed.

h2. Noncompliant Code Example

This noncompliant code example accepts only valid ASCII characters and deletes any non-ASCII characters. It also checks for the existence of a {{<script>}} tag.  

Input validation is being performed before the deletion of non-ASCII characters. Consequently, an attacker can disguise a {{<script>}} tag and bypass the validation checks.

{code:bgColor=#FFcccc}
// "\uFEFF" is a non-character code point
String s = "<scr" + "\uFEFF" + "ipt>"; 
s = Normalizer.normalize(s, Form.NFKC);
// Input validation
Pattern pattern = Pattern.compile("<script>");
    Matcher matcher = pattern.matcher(s);
    if (matcher.find()) {
      throw new System.out.printlnIllegalArgumentException("Found black listed tagInvalid input");
}   else {}

  // ... 
}

// Deletes noncharacter code points
 all non-valid characters 
s = s.replaceAll("^[\\p{ASCIICn}]", "");
// s now contains "<script>"
{code}


h2. Compliant Solution

This compliant solution replaces the unknown or unrepresentable character with Unicode sequence {{\uFFFD}}, which is reserved to denote this condition. It also does this replacement before doing any other sanitization, in particular, checking for {{<script>}}. This ensures that malicious input cannot bypass filters.  

{mc}
Strange things are happening with the regex below. Our bot inserts a link to the same rec within the code regex.
{mc}

{code:bgColor=#ccccff}
String s = "<scr" + "\uFEFF" + "ipt>";

    return s;
  }

  public static void main(String[] args) {
    // "\uFDEF" is a noncharacter code point
    String maliciousInput = "<scr" + "\uFDEF" + "ipt>";
    String sb = filterString(maliciousInput);
    // sb = "<script>"
  }
}

import java.text.Normalizer;
import java.text.Normalizer.Form;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class TagFilter {
 
  public static String filterString(String str) {
    String s = Normalizer.normalize(sstr, Form.NFKC);

    // Replaces all noncharacter non-validcode characterspoints with unicodeUnicode U+FFFD
    s = s.replaceAll("^[\\p{ASCIICn}]", "\uFFFD");

    // Validate input

    Pattern pattern = Pattern.compile("<script>");
    Matcher matcher = pattern.matcher(s);
    if (matcher.find()) {
      throw new System.out.printlnIllegalArgumentException("FoundInvalid blacklisted taginput");
    }
    return s;
  } else
  public static void main(String[] args) {
    // ... 
}
{code}

According to the Unicode Technical Report #36, Unicode Security Considerations \[[Davis 2008b|AA. References#Davis 08b]\], "{{U+FFFD}} is usually unproblematic, because it is designed expressly for this kind of purpose. That is, because it doesn't have syntactic meaning in programming languages or structured data, it will typically just cause a failure in parsing. Where the output character set is not Unicode, though, this character may not be available."

h2. Risk Assessment

Deleting noncharacter code points can allow malicious input to bypass validation checks.

|| Rule || Severity || Likelihood || Remediation Cost || Priority || Level ||
| IDS11-J | high | probable | medium | {color:red}{*}P12{*}{color} | {color:red}{*}L1{*}{color} |


h2. Related Guidelines

| [MITRE CWE|http://cwe.mitre.org/] | [CWE-182|http://cwe.mitre.org/data/definitions/182.html]. Collapse of data into unsafe value |

h2. Bibliography

|\[[API 2006|AA. References#API 06]\] | |
|\[[Davis 2008b|AA. References#Davis 08b]\] | 3.5, Deletion of Noncharacters |
|\[[Weber 2009|AA. References#Weber 09]\]| Handling the Unexpected: Character-deletion |
|\[[Unicode 2007|AA. References#Unicode 2007]\]| |
| \[[Unicode 2011|AA. References#Unicode 2011]\] | |

----
[!The CERT Oracle Secure Coding Standard for Java^button_arrow_left.png!|IDS10-J. Do not split characters between two data structures]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Oracle Secure Coding Standard for Java^button_arrow_up.png!|00. Input Validation and Data Sanitization (IDS)]&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;[!The CERT Oracle Secure Coding Standard for Java^button_arrow_right.png!|IDS12-J. Perform lossless conversion of String data between differing character encodings]

 "\uFDEF" is a non-character code point
    String maliciousInput = "<scr" + "\uFDEF" + "ipt>";
    String s = filterString(maliciousInput);
    // s = <scr?ipt>
  }