{"id":54102,"date":"2019-12-18T00:00:00","date_gmt":"2019-12-17T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii"},"modified":"2020-02-18T14:02:04","modified_gmt":"2020-02-18T11:02:04","slug":"ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","title":{"rendered":"Pou\u017eit\u00ed podobn\u00fdch Unicode symbol\u016f k obch\u00e1zen\u00ed autentizace","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

GitHub se uk\u00e1zal<\/a><\/noindex> je n\u00e1chyln\u00fd k \u00fatoku, kter\u00fd umo\u017e\u0148uje p\u0159evzet\u00ed p\u0159\u00edstupu k \u00fa\u010dtu manipulac\u00ed s Unicode znaky v e-mailu. Probl\u00e9m spo\u010d\u00edv\u00e1 v tom, \u017ee n\u011bkter\u00e9 Unicode znaky se p\u0159i pou\u017eit\u00ed funkc\u00ed pro p\u0159evod na mal\u00e1 nebo velk\u00e1 p\u00edsmena p\u0159ekl\u00e1daj\u00ed na b\u011b\u017en\u00e9 znaky s podobn\u00fdm vzhledem (kdy se n\u011bkolik r\u016fzn\u00fdch znak\u016f p\u0159ev\u00e1d\u00ed na jeden znak \u2014 nap\u0159\u00edklad tureck\u00fd znak «ı» a «i» se p\u0159i p\u0159evodu na velk\u00e1 p\u00edsmena p\u0159ev\u00e1d\u011bj\u00ed na «I»).<\/p>\n

P\u0159ed kontrolou p\u0159ihla\u0161ovac\u00edch parametr\u016f u n\u011bkter\u00fdch slu\u017eeb a aplikac\u00ed se u\u017eivatelsk\u00e1 data nejprve p\u0159ev\u00e1d\u011bj\u00ed na velk\u00e1 nebo mal\u00e1 p\u00edsmena a pot\u00e9 se kontroluj\u00ed v datab\u00e1zi. Pokud slu\u017eba umo\u017e\u0148uje pou\u017eit\u00ed unicode znak\u016f v p\u0159ihla\u0161ovac\u00edch \u00fadaj\u00edch nebo e-mailu, m\u016f\u017ee \u00fato\u010dn\u00edk vyu\u017e\u00edt podobn\u00e9 unicode znaky k proveden\u00ed \u00fatoku manipuluj\u00edc\u00edho s kolizemi v tabulk\u00e1ch p\u0159evodu znak\u016f (kolize vzor\u016f Unicode Case Mapping). <\/p>\n

‘ß’.toUpperCase() == ‘ss’.toUpperCase() \\\/\\\/ 0x0131
\n ‘K’.toLowerCase() == ‘K’.toLowerCase() \\\/\\\/ 0x212A
\n ‘John@Gıthub.com’.toUpperCase() == ‘John@Github.com’.toUpperCase()<\/p>\n

Na GitHubu \u00fato\u010dn\u00edk mohl<\/a><\/noindex> prost\u0159ednictv\u00edm formul\u00e1\u0159e pro obnovu zapomenut\u00e9ho hesla iniciovat odesl\u00e1n\u00ed k\u00f3du pro obnoven\u00ed na jin\u00fd e-mail uveden\u00edm v r\u00e1mci formul\u00e1\u0159e adresy, kter\u00e1 zahrnovala unicode znak vyvol\u00e1vaj\u00edc\u00ed kolizi (nap\u0159\u00edklad m\u00edsto mike@example.org byl uveden e-mail mı<\/b>ke@example.org). Adresa pro\u0161la kontrolou, proto\u017ee se p\u0159ev\u00e1d\u011bla na velk\u00e1 p\u00edsmena a shodovala se s p\u016fvodn\u00ed adresou (mike@example.org), ale p\u0159i odesl\u00e1n\u00ed e-mailu se odes\u00edlala tak, jak byla, a k\u00f3d pro obnoven\u00ed odch\u00e1zel na fale\u0161nou adresu (mı<\/b>ke@example.org).<\/p>\n

N\u011bkter\u00e9 z znak\u016f<\/a><\/noindex>, vyvol\u00e1vaj\u00edc\u00ed kolize p\u0159i p\u0159evodu registru:<\/p>\n

ß \t0x00DF \tSS
\n ı \t0x0131 \tI
\n ſ \t0x017F \tS
\n ff \t0xFB00 \tFF
\n fi \t0xFB01 \tFI
\n fl \t0xFB02 \tFL
\n ffi \t0xFB03 \tFFI
\n ffl \t0xFB04 \tFFL
\n ſt \t0xFB05 \tST
\n st \t0xFB06 \tST
\n K \t0x212A \tk<\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u0430\u043c\u0438 \u0432 email. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u0442\u0435\u043c, \u0447\u0442\u043e \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b Unicode \u043f\u0440\u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0439 \u043f\u0440\u0435\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043d\u0438\u0436\u043d\u0438\u0439 \u0438\u043b\u0438 \u0432\u0435\u0440\u0445\u043d\u0438\u0439 \u0440\u0435\u0433\u0438\u0441\u0442\u0440 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0431\u044b\u0447\u043d\u044b\u0435 \u0441\u0438\u043c\u0432\u043e\u043b\u044b, \u0431\u043b\u0438\u0437\u043a\u0438\u0435 \u043f\u043e \u043d\u0430\u0447\u0435\u0440\u0442\u0430\u043d\u0438\u044e (\u043a\u043e\u0433\u0434\u0430 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0437\u043d\u044b\u0445 \u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u043e\u0434\u0438\u043d \u0441\u0438\u043c\u0432\u043e\u043b — \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0442\u0443\u0440\u0435\u0446\u043a\u0438\u0439 \u0441\u0438\u043c\u0432\u043e\u043b «ı» \u0438 «i» […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-54102","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Pou\u017eit\u00ed podobn\u00fdch Unicode znak\u016f k obch\u00e1zen\u00ed autentifikace | ProHoster","description":"GitHub byl podroben \u00fatoku, kter\u00fd umo\u017e\u0148uje p\u0159evz\u00edt p\u0159\u00edstup k \u00fa\u010dtu prost\u0159ednictv\u00edm manipulace s.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043f\u043e\u0445\u043e\u0436\u0438\u0445 Unicode-\u0441\u0438\u043c\u0432\u043e\u043b\u043e\u0432 \u0434\u043b\u044f \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 | ProHoster","og:description":"GitHub \u043e\u043a\u0430\u0437\u0430\u043b\u0441\u044f \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0430\u0442\u0430\u043a\u0435, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0435\u0439 \u0437\u0430\u0445\u0432\u0430\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0443\u0447\u0451\u0442\u043d\u043e\u0439 \u0437\u0430\u043f\u0438\u0441\u0438 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441.","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/ispolzovanie-pohozhih-unicode-simvolov-dlya-obhoda-autentifikatsii","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-12-17T21:00:00+00:00","article:modified_time":"2020-02-18T11:02:04+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"54102","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-24 10:02:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 20:12:23","updated":"2026-01-24 10:02:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/54102","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=54102"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/54102\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=54102"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=54102"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=54102"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}