Commit Graph

273 Commits (master)

Author SHA1 Message Date
Noah Kissinger 4e883386ae
Update README.md
new social link!
2018-11-16 10:15:23 -05:00
emeth- 42a4d4a8c8
Update README.md 2018-11-16 04:40:27 -08:00
Jason Howell 792dcafcae Added a string with RTL text and LTR numbers in parentheses. 2018-11-16 00:34:24 -08:00
Max Woolf f56ff6ea82
Merge pull request #167 from lifengdvnera/master
Add super Unicode string
2018-11-16 00:15:47 -08:00
Lifeng Dong 980f181e22 Add super Unicode string 2018-11-15 16:55:21 +08:00
James Osborn 5df0dca3aa
Added Ogham Text
The only unicode alphabet to use a space which isn't empty but should still act like a space.
2018-10-22 18:48:12 +01:00
James Osborn 859d100fad
Added Ogham Text
The only unicode alphabet to use a space which isn't empty but should still act like a space.
2018-10-22 18:46:30 +01:00
James Osborn a4d7bba6fb
Added Ogham Text
The only unicode alphabet to use a space which isn't empty but should still act like a space.
2018-10-22 18:44:24 +01:00
James Osborn 377d24ab55
Added Ogham Text
The only unicode alphabet to use a space which isn't empty but should still act like a space.
2018-10-22 18:43:54 +01:00
Max Woolf 4115c9deee
Merge pull request #162 from charlier/resync-json
Syncronise blns JSON with txt
2018-08-05 19:12:03 -07:00
Max Woolf 8661d3fa75
Merge pull request #159 from Avaq/patch-1
Add "then" to strings which may be used elsewhere
2018-05-24 09:39:27 -07:00
Max Woolf e8f7db444c
Merge pull request #163 from dospunk/patch-1
Adds shrug to the category "Japanese Emoticons"
2018-03-19 14:19:55 -07:00
dospunk ac1af9ad28
Adds shrug to the category "Japanese Emoticons"
¯\_(ツ)_/¯ this guy
2018-03-19 15:39:56 -04:00
Charlie Rogers 8932af02f6
Syncronise blns JSON with txt 2018-03-11 23:29:36 +00:00
Max Woolf ba3c0bae5a
Merge pull request #161 from iljavs/master
update blns to account for more format strings
2018-02-25 20:06:28 -08:00
iljavs 2a9a2c9975
update blns to account for more format strings
Made a couple of changes to the format strings:
- added more %s'. increases the chance of crashing. Sometimes the stack layout is just right and 1 or 2 %s will not cause a crash 
- added %n. Should cause a crash, even if several other specifiers don't
- added %@, this is for objective-c format functions.
2018-02-25 04:24:55 -06:00
Max Woolf cf2b864ab7
Merge pull request #160 from Plazmaz/patch-2
Added new character for crashing iOS
2018-02-22 10:53:36 -08:00
Dylan Katz 1ec5bff108
Added new character for crashing iOS 2018-02-15 14:49:23 -07:00
Aldwin Vlasblom 85bc805f4f
Add "then" to strings which may be used elsewhere
The massive adoption of Promises made many programs potentially vulnerable to "accidental Promises".

In short, a program might take user input and produce an object as such:

```js
{
  [userInput]: AnyFunction
}
```

...when the object above is given to a Promise, nothing breaks until the user input is exactly `"then"`. Once it's *then*, a Promise will assume that the object as another Promise, and in trying to assimilate this accidental Promise the function will be called. After that, one of three things will happen

1. The function calls one of the continuations provided by the Promise, and the program continues with some unexpected data (this is highly unlikely)
1. The program hangs and never terminates (if the function stores input in memory)
1. The program terminates early, failing to execute any other chained Promises (the more likely case)

For more in-depth information, please refer to the appropriate sections in the articles I've written regarding this issue:

1. [Broken Promises - Specialized API](https://medium.com/@avaq/broken-promises-2ae92780f33#6828)
1. [A clarification with examples to the article above](https://medium.com/@avaq/im-referring-to-the-fact-that-a-promise-is-eagerly-evaluated-as-opposed-to-lazily-evaluated-5385cc519e3b#33cd) (see the part under "I never found myself creating an object with a then method")
2017-11-10 15:28:20 +01:00
Max Woolf c0b5382124 Merge pull request #149 from Erikmitk/patch-1
Fix broken link in README
2017-05-26 10:09:44 -07:00
Erik Sommer c30c269cde Fix broken link in README 2017-04-04 14:18:31 +02:00
Max Woolf 8a11558493 Merge pull request #125 from zackw/add-c0-and-c1-controls
Add control characters and whitespace
2017-01-19 22:45:09 -08:00
Max Woolf 96f50492b2 Merge branch 'master' into add-c0-and-c1-controls 2017-01-19 22:44:59 -08:00
Max Woolf 47b41540e0 Merge pull request #127 from davbo/include-characters-which-change-length-when-lowercased
Unicode chars which change length when lowercased
2017-01-19 22:43:57 -08:00
Max Woolf e7f864310c Merge pull request #128 from Luke-Diamond/master
Added `File:///` Vulnerability
2017-01-19 22:41:29 -08:00
Max Woolf 6f8b6d93d9 Merge pull request #129 from Plazmaz/patch-1
Added new iOS Crash String.
2017-01-19 22:41:16 -08:00
Dylan Katz 3f7bba623d Update blns.txt 2017-01-19 15:32:39 -07:00
Luke 115c1092c3 Added File:/// for Mac Vulnerability 2017-01-19 12:47:06 -05:00
Luke 1561d9e19c Added File:/// for Mac Vulnerability 2017-01-19 12:46:38 -05:00
David King 0b0f6ec999
Unicode chars which change length when lowercased
These two characters change byte length when lowercased which is quite
unique behavior. This can potentially cause issues where assumptions
about input length == length after processing.
2017-01-19 15:07:22 +00:00
Zack Weinberg 1775ec88b8 Regenerate derived files. 2017-01-19 08:38:59 -05:00
Zack Weinberg a34eb03d01 Merge branch 'master' into add-c0-and-c1-controls 2017-01-19 08:24:33 -05:00
Zack Weinberg b3c84aaf50 Remove trailing space characters from several strings where it does not appear to be part of the naughtiness. 2017-01-19 08:18:49 -05:00
Zack Weinberg 2e4f47ddc9 Include all Unicode whitespace and control characters at least once. 2017-01-19 08:16:10 -05:00
Max Woolf 942eb29775 Merge pull request #119 from topaz/patch-1
Add missing newline to delimit sections in blns.txt
2017-01-16 13:35:35 -08:00
Eric Wastl 673da196fc Add missing newline to delimit sections in blns.txt 2017-01-16 16:32:54 -05:00
Max Woolf 8694501f8d Merge pull request #116 from AnthonySteele/Add-the-famous-dvd
Add the famous dvd
2017-01-16 08:19:59 -08:00
Anthony Steele eb008e5366 Update blns.json 2017-01-16 16:08:22 +00:00
Anthony Steele cf63e259ca Update blns.txt 2017-01-16 16:07:32 +00:00
Max Woolf b8e7387e7b Merge pull request #115 from hjkuijf/master
HTML textarea
2017-01-16 07:56:23 -08:00
hjkuijf 2ea9147278 This causes an HTML textarea that is filled with unescaped input to break and execute a simple JavaScript. 2017-01-16 16:50:21 +01:00
Max Woolf d46ed585fe Add Reddit thread 2017-01-16 07:48:44 -08:00
Max Woolf 98056309f9 Merge pull request #110 from sharpjs/modem-hangup
Add modem hangup vulnerability.
2017-01-16 07:41:08 -08:00
Max Woolf 82af50aa54 Merge branch 'master' into modem-hangup 2017-01-16 07:40:59 -08:00
Max Woolf 9e78b6e801 Merge pull request #109 from annashipman/master
Year should be year of original publication
2017-01-16 07:37:37 -08:00
Max Woolf 22e581c808 Merge pull request #108 from Aeolun/master
Put table back after we are done with it
2017-01-16 07:36:35 -08:00
Max Woolf a6bd55445f Merge pull request #106 from RomainGehrig/master
Add signed zero
2017-01-16 07:35:59 -08:00
Jeff Sharp 5c290e94ce Add modem hangup vulnerability.
This string can cause some modems to disconnect.  Years ago, I triggered
this behavior accidentally when, for an unrelated reason, my email
signature contained the string.  Mail sent to a mailing list caused some
subscribers' modems to disconnect.

Explained here, in the final paragraph under "Hayes' Solution":
https://en.wikipedia.org/wiki/Hayes_command_set
2017-01-16 07:32:24 -06:00
Anna Shipman b1bd98632a Year should be year of original publication
The aim of the year is to indicate when the work was originally published, in case of any dispute. You're not in the UK but this, from the UK's copyright service is useful: http://www.copyrightservice.co.uk/copyright/p03_copyright_notices, item 4.
2017-01-16 11:26:24 +00:00
Bart Riepe 6f02d4b45e Put table back after we are done with it 2017-01-16 18:38:15 +09:00