GitHub ToLowercase Hack
From the Lower-case-the-draw-bridge Dept.
The benign-looking, ubiquitous ToLowerCase function was exploited to take over GitHub accounts. This is another example of real life languages not conforming to rigid programming rules.
“a collision occurs when two different characters are uppercased or lowercased into the same character”
My main takeaways are -
- ToLowercase / ToUppercase has security implications, so don’t automatically pass over in code reviews.
- Don’t trust untrusted user input, especially if you already have trusted user input.
References
https://spaceraccoon.github.io/unicollider/ https://www.bugcrowd.com/blog/hacking-unicode-like-a-boss/ https://github.com/jagracey/Awesome-Unicode#one-to-many-case-mappings