GitHub Nws muaj kev cuam tshuam rau kev tawm tsam uas tso cai rau koj mus txeeb nkag mus rau hauv tus account los ntawm kev tswj hwm cov cim Unicode hauv email. Qhov teeb meem yog tias qee cov cim Unicode, thaum siv tus lej qis lossis tus lej loj hloov pauv, tau muab txhais ua cov cim tsis tu ncua uas zoo sib xws (thaum ob peb lub cim sib txawv tau muab txhais ua ib tus cim - piv txwv li, tus cim Turkish "Δ±" thiab "i. "thaum hloov mus rau cov ntaub ntawv loj yog hloov mus rau "Kuv").
Ua ntej tshawb xyuas tus ID nkag mus tsis nyob rau hauv qee cov kev pabcuam thiab kev siv, cov ntaub ntawv siv los ntawm cov neeg siv khoom yog thawj zaug hloov mus rau cov ntaub ntawv sab saud lossis qis thiab tom qab ntawd txheeb xyuas hauv cov ntaub ntawv. Yog tias ib qho kev pabcuam tso cai siv cov cim unicode hauv kev nkag lossis email, tus neeg tawm tsam tuaj yeem siv cov cim unicode zoo sib xws los ua qhov kev tawm tsam uas tswj kev sib tsoo hauv Unicode Case Mapping Collisions.
'Γ'.toUpperCase() == 'ss'.toUpperCase() // 0x0131
'K'.toLowerCase() == 'K'.toLowerCase() // 0x212A
'John@GΔ±thub.com'.toUpperCase() == '[email tiv thaiv]'.toUpperCase()
Attacker ntawm GitHub los ntawm daim ntawv rau rov qab tsis nco qab lo lus zais, pib xa tus lej rov qab mus rau lwm tus email los ntawm kev qhia hauv daim ntawv chaw nyob uas suav nrog tus cim unicode uas ua rau muaj kev sib tsoo (piv txwv li, tsis yog. [email tiv thaiv] email m tau qhiaΔ±[email tiv thaiv]). Qhov chaw nyob dhau qhov kev xeem vim tias nws tau hloov pauv mus rau qhov loj thiab sib phim qhov chaw nyob qub ([email tiv thaiv] ), tab sis thaum xa tsab ntawv nws raug hloov raws li yog thiab tus lej rov qab tau xa mus rau qhov chaw nyob cuav (mΔ±[email tiv thaiv]).
Ib txhia ntawm , ua rau muaj kev sib tsoo thaum hloov npe:
Γ 0x00DF SS
ib 0x0131i
0x017f ua
F 0xFB00 FF
0xFB01 FI
fl 0xFB02 FL
ο¨ 0xFB03 FFI
0xFB04 FFL
0xFB05 ST
ο¬ 0xFB06 ST
K 0x212A k
Tau qhov twg los: opennet.ru