I don't deal with user input validation, but any resources for reading about handling various inputs like the ones in blns?
Show HN: Big List of Naughty Strings for testing user-input data
21–30 of 80 posts
Re: Show HN: Big List of Naughty Strings for testing user-input data
#22Most of what I do involves the messy world of text, and I think this is a great resource. I wish the software I depended on tested against it. I can think of a few more cases that I've seen cause havoc: - U+FEFF in the middle of a string (people are used to seeing it at the beginning of a string, because Microsoft, but elsewhere it may be more surprising) - U+0 (it's encoded as the null byte!) - U+1B (the codepoint f…
Isolated UTF-16 surrogate code points definitely crash Unity when it tries to display them. (Seen when I pasted some emoji in a text box in TIS-100 and tried to backspace.)
Re: Show HN: Big List of Naughty Strings for testing user-input data
#23Most of what I do involves the messy world of text, and I think this is a great resource. I wish the software I depended on tested against it. I can think of a few more cases that I've seen cause havoc: - U+FEFF in the middle of a string (people are used to seeing it at the beginning of a string, because Microsoft, but elsewhere it may be more surprising) - U+0 (it's encoded as the null byte!) - U+1B (the codepoint f…
This. Hidden white space has ruined my day before!
Re: Show HN: Big List of Naughty Strings for testing user-input data
#24This is good. There are lots of lists like this; you might find additional strings to add to it here: https://code.google.com/p/fuzzdb/ Fuzz lists are to web pentesters what drain snakes are to plumbers.
Another good list that incorporates FuzzDB: https://github.com/danielmiessler/SecLists
As other commenters noted, strings like DROP TABLES should be used with caution!
Re: Show HN: Big List of Naughty Strings for testing user-input data
#25Most of what I do involves the messy world of text, and I think this is a great resource. I wish the software I depended on tested against it. I can think of a few more cases that I've seen cause havoc: - U+FEFF in the middle of a string (people are used to seeing it at the beginning of a string, because Microsoft, but elsewhere it may be more surprising) - U+0 (it's encoded as the null byte!) - U+1B (the codepoint f…
The range U+FDD0..U+FDEF is reserved for internal use by applications.
Re: Show HN: Big List of Naughty Strings for testing user-input data
#26Nice "in the beginning..." hebrew string: בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ
Full context, this is the beggining of the bible.
Re: Show HN: Big List of Naughty Strings for testing user-input data
#27Most of what I do involves the messy world of text, and I think this is a great resource. I wish the software I depended on tested against it. I can think of a few more cases that I've seen cause havoc: - U+FEFF in the middle of a string (people are used to seeing it at the beginning of a string, because Microsoft, but elsewhere it may be more surprising) - U+0 (it's encoded as the null byte!) - U+1B (the codepoint f…
BOMs have already caught me off guard at the start of strings.
Re: Show HN: Big List of Naughty Strings for testing user-input data
#28" # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153 ) /dev/null; rm -rf /*; echo " That's a little aggressive for testing no?
Some would argue that if you're testing on a system you can't recreate easily/quickly, you're doing devops wrong.
Re: Show HN: Big List of Naughty Strings for testing user-input data
#29The list seems to be missing the simplest naughty string of all: The empty string!
(Well, the text file has empty lines separating the comments and example strings so it technically includes the empty string, but it's not in the JSON file.)
Re: Show HN: Big List of Naughty Strings for testing user-input data
#30" # Server Code Injection # # Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153 ) /dev/null; rm -rf /*; echo " That's a little aggressive for testing no?
Accepted a pull request which is nicer.