hunting-unicode-normalization-and-canonicalization-bypass

Hunting unicode normalization and canonicalization bypass: when the check and the sink read different strings

A security check compares a string against a rule: this path stays under the root, this name is not on the denylist, this identifier equals the owner's. The comparison is only sound if the string being checked is the same string the sink will act on. Text has many representations, and systems transform it constantly: they normalize Unicode, decode percent- or entity-encoding, and fold case, often after the check has already passed. When the transform happens between the check and the sink, an attacker submits a form that looks safe to the check and becomes dangerous at the sink. A denied word slips through in a composed form that normalizes back to it; an identity check passes because two different code points fold to the same letter; a homoglyph domain reads as the real one. The bug is an ordering bug: canonicalize after you check. You find these by locating each security decision and asking whether it runs on the same canonical form the sink uses.

When to use

• An authorization, filter, allowlist, or denylist decision runs on a string that is later transformed.
• Path containment, host comparison, or an identifier equality check precedes a decode or normalization.
• Usernames, emails, domains, or filenames are compared or displayed across scripts and encodings.

Scope check

Test normalization and canonicalization behavior only against systems you own or are authorized to assess, from test accounts, using benign markers to demonstrate that a check is bypassed rather than acting on the access it grants. A confirmed bypass reaches protected functions or identities, so stay within the authorized scope. If you can't name the authorization, stop.

The loop

1. Establish whether the check and the sink use the same canonical form first. For each security decision, determine the representation it inspects and the representation the sink finally acts on, and whether any normalization, decoding, or case-folding happens between them. This is the false-positive killer: a system that canonicalizes input to a single form and then both checks and acts on that form is not bypassable, while one that checks the raw or partly-decoded input and transforms it afterward is. Name the order of check and transform before crafting input.