Re: Advisory: Attack of the Mongolian space evaders... (and other Medieval XSS vectors)

[Log0 <ky.log0 () gmail com>]

Dear Chris,

Very interesting findings. Except :

U+2002 to U+200A
U+205F
U+3000
U+180E Mongolian Vowel Separator
U+1680 Ogham Space Mark

I found that unicode characters below also plagued Opera 9.51 .

U+00A0
U+180F
U+2000
U+2001
U+2028
U+2029
U+202F
U+205F

Got to dig out what is behind the scenes to why it happens. You suggested
interesting tips to me about the character properties. Thank you for
sharing!

For those who are interested, the comments contains more details :

http://lookout.net/2008/08/26/advisory-attack-of-the-mongolian-space-evaders-and-other-medieval-xss-vectors/
http://log0.wordpress.com/2008/09/16/interesting-xss-in-opera-951/

-- 
Best Regards
Log0

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/