Are there any lists of unicode characters (like the OWASP one) that should be blacklisted from most apps (not just for XSS, but even for desktop apps)?
Are there any good security guides/best practices for unicode sanitation?
Are there any good security guides/best practices for unicode sanitation?
1) once you've read the first LTR you end in the right place for the RTL
2) even if you consider the LTRs to be two distinct documents it doesn't change the order. I can imagine the LTR 'breaking' the RTL text such that the sections are treated separately.
But I understand what you were saying, so thanks for the answer!
On 2, I’m not sure I understand. The situation is the same for both primary directions.
YES.
There are legitimate uses of BiDi control characters. My favorite one from my time on Android was the string "Google+", which would render as "+Google" in an RTL paragraph. The translators would usually "fix" this by just flipping the string so that it was "+Google", which would render correctly, but be incorrect when cut'n'pasted, read by a screen reader, etc. The correct solution is to use a left-to-right mark. The string "Google\u{200e}+" renders correctly in both LTR and RTL flow. And these "mark" characters are basically harmless, they cannot profoundly change the order, they just fix some of these ambiguous cases.
Correct use of BiDi control characters is explained here: https://www.w3.org/International/questions/qa-bidi-unicode-c...
https://github.com/danielmiessler/SecLists/blob/master/Fuzzi...
# Human injection
#
# Strings which may cause human to reinterpret worldview
If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you.The report is divided into visual and non-visual security issues. Our old friend RTL override is covered, but mostly in the context of URLs.
Anyways unicide category Cf is probably what you are looking for, but blocking them is probably wrong as they serve an important function.