Unicode Normalisation Attack

Also Known As

TL;DR

Explanation

Unicode defines multiple normalisation forms (NFC, NFD, NFKC, NFKD). A character like 'é' can be represented as a single codepoint U+00E9 or as 'e' plus a combining accent U+0301. A blocklist filter checking raw bytes may miss the decomposed form, which later normalises to the blocked character after storage or rendering. PHP's intl extension provides Normalizer::normalize() to canonicalise input before validation. Always normalise user input to NFC before validation and storage; never rely solely on byte-level comparisons for security-sensitive checks.

Common Misconception

Why It Matters

Common Mistakes

• Comparing usernames or email addresses for uniqueness without normalising to NFC or NFKC first.
• XSS filters that match ASCII angle brackets but miss Unicode alternatives that browsers render identically.
• File path security checks that pass but the filesystem resolves to a different path via Unicode canonicalization.
• Not using Normalizer::normalize() before storing or comparing user-supplied strings containing Unicode.

Avoid When

• Do not skip normalisation for filenames — different Unicode representations of the same filename can bypass path traversal filters.
• Do not compare usernames or emails for uniqueness without first normalising — homograph attacks exploit visually identical but byte-different characters.

When To Use

• Normalise all user-supplied strings to NFC form before comparison, storage, or security checks.
• Apply unicode normalisation before checking string equality — 'café' composed vs decomposed are different byte sequences but the same character.

Code Examples

// Different Unicode representations of same visual character
// Filter applied before normalisation — bypass possible
\$input = \$_POST['username'];
if (preg_match('/[<>"\']/u', \$input)) abort(400);
// Attacker sends NFD form of < → passes filter → XSS in output

// Normalise to NFC BEFORE any validation
\$input = Normalizer::normalize(\$_POST['username'] ?? '', Normalizer::FORM_C);

// Now validate on canonical representation
if (!preg_match('/^[\p{L}\p{N}._@-]+$/u', \$input)) abort(400);

// Prevent homograph attacks (visually identical chars from different scripts):
// 'a' (U+0061 Latin) vs 'а' (U+0430 Cyrillic) — restrict to expected script

References

• ↗ https://www.php.net/manual/en/class.normalizer.php

Tags

Related Terms