From: Chris Morgan Date: Wed, 5 Jan 2022 06:11:32 +0000 (+1100) Subject: 1.0.0 X-Git-Url: https://git.chrismorgan.info/sanitise-file-name/commitdiff_plain/2f75e28d1f5d097ae5931fd05dd1b4fe39ec8c08 1.0.0 --- 2f75e28d1f5d097ae5931fd05dd1b4fe39ec8c08 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..96ef6c0 --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/target +Cargo.lock diff --git a/COPYRIGHT b/COPYRIGHT new file mode 100644 index 0000000..2cced42 --- /dev/null +++ b/COPYRIGHT @@ -0,0 +1,17 @@ +Copyright © 2022 Chris Morgan + +This project is distributed under the terms of three different licenses, +at your choice: + +- Blue Oak Model License 1.0.0: https://blueoakcouncil.org/license/1.0.0 +- MIT License: https://opensource.org/licenses/MIT +- Apache License, Version 2.0: https://www.apache.org/licenses/LICENSE-2.0 + +If you do not have particular cause to select the MIT or the Apache-2.0 +license, Chris Morgan recommends that you select BlueOak-1.0.0, which is +better and simpler than both MIT and Apache-2.0, which are only offered +due to their greater recognition and their conventional use in the Rust +ecosystem. (BlueOak-1.0.0 was only published in March 2019.) + +When using this code, ensure you comply with the terms of at least one of +these licenses. diff --git a/Cargo.toml b/Cargo.toml new file mode 100644 index 0000000..e30d192 --- /dev/null +++ b/Cargo.toml @@ -0,0 +1,30 @@ +[package] +name = "sanitise-file-name" +description = "An unusually flexible and efficient file name sanitiser" +authors = ["Chris Morgan "] +license = "BlueOak-1.0.0 OR MIT OR Apache-2.0" +version = "1.0.0" +edition = "2021" +keywords = ["sanitiser", "filename", "sanitizer"] +categories = ["filesystem", "text-processing"] +repository = "https://gitlab.com/chris-morgan/sanitise-file-name" +# The test matrix arrangement produces >800KB of files, uncompressed, +# so I’m excluding them from publish; go to the source repo if you want it all. +exclude = [".gitignore", "tests/"] + +[package.metadata.docs.rs] +all-features = true +rustdoc-args = ["--cfg", "docsrs"] + +[features] +default = ["std"] +std = ["alloc"] +alloc = [] +const-fn-trait-bound = [] + +[dev-dependencies] +# Only the tests depend on rustc_1_55. +tinyvec_string = { version = "0.3", features = ["rustc_1_55"] } + +[dependencies] +tinyvec_string = { version = "0.3", optional = true } diff --git a/README.md b/README.md new file mode 100644 index 0000000..946dbde --- /dev/null +++ b/README.md @@ -0,0 +1,45 @@ +# sanitise-file-name: an unusually flexible and efficient file name sanitiser + +At the time of writing, I believe this to be one of the very best file name sanitisers around (comparing it with extant Rust options like sanitize-filename and sanitize-filename-reader-friendly, and other implementations I found for environments like Node.js and Python; I didn’t look at anything C/C++). + +- It’s faster: while its flexibility may act against it in some cases (depending on the optimiser), it starts out with the substantial advantage of making exactly one allocation, whereas the alternatives (even Rust ones like sanitize-filename and sanitize-filename-reader-friendly) make at least three or four, normally quite a few more. (Note that I haven’t done any benchmarking comparison.) What’s more, it lets you keep on reusing one large-enough buffer if you want, for amortised *zero* allocations. + +- It’s better documented: each option declares precisely what it does, why you might care, and sometimes gives extra suggestions (e.g. “if you want to support HFS+, normalise to NFD first so the length limit is correct”). + +- It’s more flexible: you can choose whether you want things like Windows-safety and URL-safety, plus there are more options for producing probably-prettier results (mostly inspired a bit by sanitize-filename-reader-friendly). + +- It’s more correct: it doesn’t remove unnecessary characaters and *does* remove all necessary characters (a surprisingly rare combination, though certainly not unknown); and length limitations (implemented correctly as UTF-8 code units rather than UTF-16 code units or Unicode code points or scalar values) truncate the base name rather than the extension where possible (now *this* is a feature that I haven’t found in any other library; and if you prefer to append the extension afterwards, I’ve got you covered, including adjusting the length limitation, which is *also* a feature that I haven’t found in any other library). + +- It behaves in a platform- and file-system-neutral way, because matching the local platform’s behaviour is just asking for trouble, especially in cases where you can’t accurately detect the file system in use. Instead, it supports all even vaguely popular file systems by default (which only care about ␀ and `/`), and you can opt out of Windows support since it’s the only one with even mildly cumbersome rules. + - But ext3cow, which doesn’t allow `@`, is not supported. + - And HFS+ environments where `:` is reserved are only supported incidentally via Windows-safety; but I believe (without having definitely confirmed this) that that’s pretty much ancient history, Mac OS 9 or so from memory. + +- It doesn’t even require `std` or `alloc` (though they’re enabled by default): it can support `tinyvec_string::ArrayString`, requiring no more than 510 bytes under the default options (and only that much because of extension cleverness). + +- It uses *The Original And The Best™* English. (That is: *sanitise* instead of *sanitize*, and *file name* instead of *filename*.) ——Though as a concession to Americans, the functions are also exported under the spelling *sanitize*; but you’ll still have to steel yourselves to spelling it *sanitise* in the crate name. + +Demonstration of the simplest and most convenient form of usage: + +```rust +use sanitise_file_name::sanitise; + +fn main() { + // Examples of some of the things it can do: + // whitespace is collapsed to one space, + // various ASCII puntuation gets replaced by underscores, + // outer whitespace is trimmed. + // (There are reasons for each of these things, + // and they can all be turned off or customised with options.) + assert_eq!( + sanitise(" https://example.com/Some\tfile \u{a0} name .exe "), + "https___example.com_Some file name.exe", + ); + + // The windows_safe option leads to the addition of the underscore. + assert_eq!(sanitise("aux.h"), "aux_.h"); +} +``` + +`sanitise_file_name::Options` docs explain all sanitisation functionality precisely. And all of it is customisable. + +This crate supports no_std operation and has several other Cargo features; refer to the root of the crate docs for information. diff --git a/src/lib.rs b/src/lib.rs new file mode 100644 index 0000000..a54ab33 --- /dev/null +++ b/src/lib.rs @@ -0,0 +1,1292 @@ +//! Sanitise names for use in file systems and the likes. +//! +//! The output string is guaranteed to be shorter than or equal to the input string in length, +//! except for file names that are reserved on Windows (see [`Options::windows_safe`]), in which +//! case an underscore is appended to the base name (e.g. NUL → NUL_, aux.h → aux_.h). +//! +//! The key parts of the API: +//! +#![cfg_attr(feature = "alloc", doc = "\ + - [sanitise][](input: &str) -> String: the simplest thing to call; + + - [sanitise_with_options][](input: &str, options: &Options<_>) -> String: + when you want to tweak the nature of the sanitisation; and")] +#![cfg_attr(not(feature = "alloc"), doc = "\ + - [sanitise][](input: &str) -> String: the simplest thing to call + *(disabled in this build due to compiling without the `alloc` feature)*; + + - [sanitise_with_options][](input: &str, options: &Options<_>) -> String: + when you want to tweak the nature of the sanitisation *(disabled in this build due to + compiling without the `alloc` feature)*; and")] +//! +//! - [`Options`], with detailed descriptions of each option. +//! +//! And for advanced users that want to control allocations or other similar things: +//! +//! - [sanitise_to][](input: &str, options: &Options<_>, out: &mut String), +//! sanitising into +#![cfg_attr(feature = "alloc", doc = " a `String`")] +#![cfg_attr(not(feature = "alloc"), doc = " a string")] +#![cfg_attr(feature = "tinyvec_string", doc = " or [`tinyvec_string::ArrayString`]")] +#![cfg_attr(all(docsrs, feature = "tinyvec_string"), doc = " (when enabled)")] +//! that you provide, +//! for which the following methods may help: +//! +//! - [max_alloc_size][](options: &Options<_>) or +//! [max_alloc_size_const][](options: &Options<Option<char>>), +//! to suggest a size for scratch buffer +#![cfg_attr(feature = "tinyvec_string", doc = " or `ArrayString`")] +//! applications; and +//! +//! - [sufficient_alloc_size][](input: &str, options: &Options<_>) -> usize, to +//! suggest a size that will definitely be sufficient for one given input (mainly useful when you +//! are crafting a path with stuff before and after it). +//! +//! … but that’s dangerous territory, deep rabbit holes; ask if you actually *need* them—don’t be +//! like me. (When I am laid in earth, may my wrongs create no trouble in thy breast. Remember me, +//! but ah! forget my fate.) +//! +//! ### Conditional compilation/Cargo features +//! +//! This crate has several features: +//! +//! - **std**, enabled by default. Implies *alloc*. Disable it to get `#![no_std]` operation. +//! +//! - **alloc**, enabled by default via *std*. Provides the ability to sanitise to a `String` in +//! `sanitise_to`, and the `sanitise` and `sanitise_with_options` functions. +//! +//! - **tinyvec_string**, disabled by default. Provides the ability to sanitise to +//! `tinyvec_string::ArrayString`, which works without *alloc*. +//! +//! - **const-fn-trait-bound**, disabled by default, requires rustc nightly at the time of writing. +//! Makes [`max_alloc_size`] const. +//! +//! These docs were built with these features enabled: +#![cfg_attr(feature = "std", doc = " std")] +#![cfg_attr(feature = "alloc", doc = " alloc")] +#![cfg_attr(feature = "tinyvec_string", doc = " tinyvec_string")] +#![cfg_attr(feature = "const-fn-trait-bound", doc = " const-fn-trait-bound")] +#![cfg_attr( + all( + not(feature = "std"), + not(feature = "alloc"), + not(feature = "tinyvec_string"), + not(feature = "const-fn-trait-bound"), + ), + doc = " *(none of them)*")] +//! +//! … and these features disabled: +#![cfg_attr(not(feature = "std"), doc = " std")] +#![cfg_attr(not(feature = "alloc"), doc = " alloc")] +#![cfg_attr(not(feature = "tinyvec_string"), doc = " tinyvec_string")] +#![cfg_attr(not(feature = "const-fn-trait-bound"), doc = " const-fn-trait-bound")] +#![cfg_attr( + all( + feature = "std", + feature = "alloc", + feature = "tinyvec_string", + feature = "const-fn-trait-bound", + ), + doc = " *(none of them)*")] + +// End docs. + +#![cfg_attr(not(feature = "std"), no_std)] +#![cfg_attr(feature = "const-fn-trait-bound", feature(const_fn_trait_bound))] +#![cfg_attr(docsrs, feature(doc_cfg))] +#![cfg_attr(not(feature = "alloc"), allow(rustdoc::broken_intra_doc_links))] // I’m lazy. + +#[cfg(feature = "alloc")] +extern crate alloc; +#[cfg(feature = "alloc")] +use alloc::string::String; + +use core::ops::{Deref, Index, Range, RangeFrom, RangeBounds}; + +/// Sanitisation options. Defaults marked on each field. +/// +/// Take a look around, but I think everything’s pretty sane by default; the ones I think you’re +/// most likely to want to change are `url_safe` and `windows_safe`, though `replace_with`, +/// `collapse_replacements` and `six_measures_of_barley` can be interesting too for yielding +/// prettier results. +/// +/// If you set `length_limit` to `usize::MAX`, all the bool fields to `false`, and +/// `six_measures_of_barley` to an empty string, `sanitise` will not alter the input string in any +/// way. But that would be a rather expensive alternative to `.clone()`. In practice, I doubt you +/// ever want to disable `most_fs_safe`, which is a good baseline. +#[derive(Debug)] +pub struct Options { + /// Limit the complete file name to this many UTF-8 code units. The default is **255**, which + /// is suitable for all practical platforms. + /// + /// (Some file systems limit lengths in UTF-8 code units and some in UTF-16 code units, but + /// UTF-16 never takes more code units than UTF-8 to encode a given Unicode string, so we can + /// ignore it.) + /// + /// Reasons you might want to reduce it: + /// + /// 1. You haven’t appended the extension yet, and so want to subtract the extension’s length. + /// (In that case I suggest writing `Options::DEFAULT.length_limit` instead of hard coding + /// 255—that’ll work in const context.) + /// + /// 2. You want smoother Windows support, for on Windows some things start falling over if the + /// total path length is greater than 260 characters; so measuring or estimating the path + /// length could potentially be useful—but unless you know, probably don’t worry too much, + /// someone’ll probably drop it deep in a node_modules tree at some point and then you’ll be + /// in trouble anyway. 😀 + /// + /// One other mildly significant note here: if you care about Apple’s pre-2017 HFS+ file + /// system, you should perform Unicode normalisation to NFD (most likely via the + /// `unicode-normalization` crate) before performing sanitisation, because the decomposed form + /// may be longer; if you don’t, then the path will be normalised to NFD by the file system + /// when you try to write it, which could take it over 255 and make it fail. I don’t think + /// there are any popular file systems that normalise any more, though APFS kinda prefers NFC, + /// so you might want to normalise to NFC. I do not know if normalising to NFC will ever + /// lengthen a UTF-8 string, but the spec allows it to (UAX #15, goal 3.2). + /// + /// The minimum permitted value is 10, for reasons of implementation convenience and because I + /// don’t think there’s any legitimate use case for a smaller value. If you provide a value + /// less than ten, you’ll get an empty string back every time. + /// + /// Truncations are performed at `char` granularity (Unicode scalar value), which means that + /// extended grapheme clusters could be broken. This could change in the future (it’ll be an + /// optional dependency on `unicode-segmentation`), but for now it was just too much thought. + /// If I ever implement this, I’ll probably ditch the minimum value of 10 too. + // (Most significantly, it doesn’t play terribly nicely with extension cleverness: six would no + // longer be sufficient to guarantee a base name, so more involved calculations and overflow + // tracking would need to be done. It’s perfectly achievable, but painful.) + pub length_limit: usize, + + /// When allocating the string (since it allocates as small a string as possible), reserve at + /// least this many extra bytes. This is good for efficiency when you append the extension + /// after sanitisation (in which case, also disable `extension_cleverness`). Default **0**. + pub reserve_extra: usize, + + /// Make other options try to be clever about a file extension in the input. Default `true`. + /// + /// Specifically, if a file extension is detected (done by looking for the last full stop in + /// the name, and splitting at that point into base name and extension): + /// + /// 1. `length_limit` will try to keep the extension intact, truncating the base name rather + /// than the extension. “Try”, because if the extension is longer than six code units less + /// than the length limit, it will be deemed unsalvageable. (Why six? The base name must + /// retain at least one character, so for convenience that’s four UTF-8 code units, plus one + /// more for the dot, and if `windows_safe` is on, the longest reserved name causes a five + /// code unit base name like `LPT1_`, and ridiculously long extensions are a corner case + /// anyway so I decided to just call it a day at six. If I subsequently implement + /// grapheme-cluster-aware truncation, this six will increase if the first grapheme cluster + /// in the base name is more than five code units long.) An unsalvageable extension is the + /// only case where sanitisation may take two steps to quiesce, rather than one: if the + /// extension is entirely truncated and the base name contains a dot which in a subsequent + /// run will be interpreted as the extension separator, trimming will happen around it on + /// that subsequent run but not the first. + /// + /// 2. `windows_safe` will detect reserved names with extensions. + /// + /// 3. `trim_spaces_and_full_stops` and `trim_more_punctuation` will trim those characters from + /// the end of the base name and the start of the extension, in addition to the start and + /// end of the full name. (Expressed otherwise, the base name and extension will be trimmed + /// independently.) + /// + /// If you’re appending the extension after sanitisation, you should turn this to false. + pub extension_cleverness: bool, + + /// Remove characters that are not safe on just about any file system. Default `true`, and if + /// you actually want to disable it you’re probably using the wrong crate. + /// + /// This plus `length_limit` is enough to satisfy most platforms other than Windows, though + /// cleaning somewhat more is probably a good idea. + /// + /// Characters removed: + /// + /// - `/` (slash) + /// - ␀ (null, character zero) + /// + /// Also disallows names comprising exclusively dots (`"."`, `".."`, `"..."`, *&c.*), NOT using + /// `replace_with` on them but yielding an empty string. + /// + /// This is a tiny subset of `windows_safe`. + pub most_fs_safe: bool, + + /// Ensure the file name is safe on Windows. Default `true`. + /// + /// [These are the rules applied:](https://docs.microsoft.com/en-au/windows/win32/fileio/naming-a-file#naming-conventions) + /// + /// - These characters are removed (and `replace_with` employed): + /// + /// - `<` (less than) + /// - `>` (greater than) + /// - `:` (colon) + /// - `"` (double quote) + /// - `/` (forward slash) + /// - `\` (backslash) + /// - `|` (vertical bar/pipe) + /// - `?` (question mark) + /// - `*` (asterisk) + /// - The C0 control characters, 0–31 and 127 (U+0000–U+001F, U+007F); note that U+007F isn’t + /// actually part of C0, but Microsoft included it in this list so I do too. + /// + /// - Names must not end with a space or a dot (so these are removed recursively—for reasons of + /// technical convenience, `replace_with` is NOT employed). + /// + /// - These names are reserved (and so a trailing underscore is added to the base name), + /// including with an extension if `extension_cleverness` is enabled: + /// + /// - CON, PRN, AUX, NUL, + /// - COM1, COM2, COM3, COM4, COM5, COM6, COM7, COM8, COM9, + /// - LPT1, LPT2, LPT3, LPT4, LPT5, LPT6, LPT7, LPT8, and LPT9 + /// + /// Most of these restrictions are actually not quite universal in Windows, but getting around + /// them requires switching into POSIX mode or using long UNC paths (e.g. `\\.\C:\CON`, + /// `\\?\D:\aux.h`), and your life will certainly be miserable if you try using them; so + /// they’re all considered not Windows-safe. + pub windows_safe: bool, + + /// Remove characters that may be problematic in the usual places in URLs. Default `false`. + /// + /// If you want something URL-safe, consider slugifying instead (see below). + /// + /// This removes any character that is not what’s called a [*URL code point*], also removes the + /// characters `&`, `/` and `?`, and forbids the names `.` and `..` which have a special + /// meaning in paths. The result is either an empty string, or suitable for use as a path + /// component, query string value or fragment, without generally *needing* percent-encoding: + /// such a URL will be correctly parsed by a WHATWG URL Standard parser, though nominally + /// invalid¹, but older or poorer-quality URL parsers may need percent-encoding to cope with + /// the non-ASCII that is retained. + /// + /// Some notable characters that are removed: `/`, `\`, `%`, `?`, `#`, `&`, `"`, and space. + /// + /// Almost all non-ASCII is retained. + /// + /// Notes on using these URLs in some common formats: + /// + /// - In HTML, no escaping is needed in ``, because `&` + /// and `"` are the only two characters needing escaping in a double-quoted attribute value, + /// and both are removed by `url_safe`. + /// + /// - In plain text formats following the longstanding convention of angle bracket delimition + /// (``), no escaping should be required as `>` is removed by + /// `url_safe`. This includes Markdown. However, some such parsers could be stricter about + /// what’s allowed inside the angle brackets, so you may need or want to use a URL Standard + /// serialiser to do percent-encoding of the non-ASCII. + /// + /// - In Markdown `[text](href)` links, you’ll want to manually percent-encode `(` to `%28` and + /// `)` to `%29`. This is yet another bad choice in Markdown’s technical foundation: + /// parentheses aren’t percent-encoded, never have been; so using a URL Standard serialiser + /// won’t help you, you’ll instead need to manually encode them, or unpaired parentheses will + /// break the link and possibly eat your laundry². + /// + /// Given that this produces nominally-invalid URLs, you may be wondering why to bother at all; + /// it really comes down to characters like `?`, `/` and `#`: you *can* include them in paths + /// by percent-encoding, but it’s too likely that *somewhere* along the way, *something* will + /// mangle your path, not encoding it properly, and everything will break—basically the entire + /// *system* has to process the URL correctly; ever tried a path component containing `%2F`? + /// But if you’ve removed the genuinely problematic characters, then in theory things can no + /// longer go wrong once you’re past the parser. And being able to skip percent-encoding your + /// URLs when you know you’ll be using a proper URL parser is nice. + /// + /// I deliberately haven’t provided an option for removing characters that would make a URL + /// nominally invalid (which is “non-ASCII”), because I think that goes too far: in such a + /// case, I don’t think you should *strip* such characters, but rather slugify the whole thing + /// (which can do things like `Voilà!` → `voila`). + /// + /// `replace_with` is used for the character removals, but NOT for the forbidding of the names + /// `"."` and `".."`, for which it will instead yield an empty string. + /// + /// —⁂— + /// + /// ¹ “Invalid” is just a label in WHATWG specs; it doesn’t change anything, and parsing is + /// still well-defined, it’s generally just a hint that either you may have made a mistake, + /// or that older tools might not handle this case the same way. + /// + /// ² When Americans say “eat your laundry” they mean the *clothes*. An Australian seeking to + /// express *that* concept would say “eat your washing” (and probably be looked at strangely + /// because it’s not an expression in common use). The laundry is the room in which clothes + /// are washed; so when I say injection attacks might eat your laundry—— + /// + /// [*URL code point*]: https://url.spec.whatwg.org/#url-code-points + pub url_safe: bool, + + /// Replace all sequences of whitespace with one space. Default `true`. + /// + /// This uses the Unicode `White_Space` property to decide ([`char::is_whitespace`]). + /// + /// This is done in two phases: + /// + /// 1. Before safety character replacements, each whitespace character is normalised to a + /// U+0020 SPACE; `replace_with` is not invoked. + /// + /// 2. After all character replacements, adjacent spaces (including any produced by + /// `replace_with`, independent of `collapse_replacements`) are collapsed to just one. + pub normalise_whitespace: bool, + + /// Remove spaces and full stops (`.`) from the start and end of the name. Default `true`. + /// + /// `normalise_whitespace` is performed before this; with it on, this will trim all whitespace, + /// with it off it’ll only trim U+0020 SPACE. + /// + /// All things that invoke `replace_with` are performed before this; thus, if you replace a + /// character with a space or full stop, that could get trimmed. `replace_with` is not invoked + /// on any characters removed by this. + /// + /// If `extension_cleverness` is enabled (which it is by default), on names with an extension + /// this trims from the start and end of the base name and extension independently, rather than + /// just the start and end of the full string. That is, `" foo . bar . baz "` will become + /// `"foo . bar.baz"` with `extension_cleverness`, and `"foo . bar . baz"` without. + /// + /// This is independent of `windows_safe`, which also trims trailing spaces and dots from the + /// complete name. + // BTW: U+002E is named FULL STOP, oh uncouth Americans. 😀 + pub trim_spaces_and_full_stops: bool, + + /// Remove a few more punctuationy characters from the start and end of the name. + /// Default `true`. + /// + /// This is a more aggressive supplement to `trim_spaces_and_full_stops`, trimming from the + /// same places in the same way. These characters are removed: + /// + /// - `_` (underscore; especially significant because `replace_with` defaults to an underscore) + /// - `-` (hyphen/dash/minus) + /// - `,` (comma) + /// - `;` (semicolon) + pub trim_more_punctuation: bool, + + /// Remove control characters. Default `true`. + /// + /// This removes all characters with the general category *Control*: C0 controls U+0000–U+001F, + /// control character U+007F, and C1 controls U+0080–U+009F. + /// + /// `replace_with` is invoked on these removals. + pub remove_control_characters: bool, + + /// Remove BiDi control characters that are relevant to reordering attacks. Default `true`. + /// + /// is a paper with info about the attack. + /// + /// This removes U+202A–U+202E and U+2066–U+2069. It does NOT remove the remaining three + /// Bidi_Control characters U+061C, U+200E and U+200F (ALM, LRM, RLM), + /// which are not implicated in the attack and are conceivably useful in file names. + /// + /// `replace_with` is invoked on these removals. + pub remove_reordering_characters: bool, + + /// Where characters are removed (except as marked), replace them with this. + /// Default `Some('_')`. + /// + /// If you provide a character that would normally be removed, it will not be removed: that + /// processing is done once only. + /// + /// If you provide a character that would be trimmed, it may or may not be trimmed: end matches + /// will be trimmed, start matches only will be if ridiculously long names and/or extensions + /// force unusual truncation, exposing the start of the string (so that it gets trimmed to + /// nothing). + pub replace_with: R, + + /// Where multiple adjacent characters are to be replaced, only replace the first, and remove + /// any subsequent ones. Default `false`. + /// + /// See also `normalise_whitespace`, which can collapse replacements if you replace with + /// whitespace. + pub collapse_replacements: bool, + + /// If sanitisation would leave the path empty, return this string instead. Default `"_"`. + /// + /// This exists because I found myself writing `if name.is_empty() { name.push('_') }` after + /// every time I called `sanitise`. I think most of the time you don’t want to be left with an + /// empty string, and inserting *something* is tolerable, so this is on by default as something + /// fairly neutral that aligns with the `replace_with` default as well. You can effectively + /// disable this by setting this to an empty string. + /// + /// `length_limit` is not taken into account on this. If you put something ridiculously long in + /// it, you brought it on yourself and I wash my hands of it, as Pontius Pilate of old. + /// + /// (Read *Ruth 3:15–17* from the Bible to understand the name of this option.) + pub six_measures_of_barley: &'static str, +} + +// Implemented on just one type for inference reasons. One might wonder why I use an associated +// constant at all. This would not be an unreasonable thing to wonder. +impl Options> { + /// The default options. This is more useful than `Options::default()` (which just returns + /// this) because it’s const, so you can access `Options::DEFAULT.length_limit` in const + /// context. + pub const DEFAULT: Self = Options { + length_limit: 255, + reserve_extra: 0, + extension_cleverness: true, + most_fs_safe: true, + windows_safe: true, + url_safe: false, + normalise_whitespace: true, + trim_spaces_and_full_stops: true, + trim_more_punctuation: true, + remove_control_characters: true, + remove_reordering_characters: true, + replace_with: Some('_'), + collapse_replacements: false, + six_measures_of_barley: "_", + }; +} + +impl Default for Options> { + fn default() -> Self { + Self::DEFAULT + } +} + +impl Options { + /// A workaround for an otherwise-messy type situation with filling in defaults. + /// + /// This solves the problem that you can’t write this: + /// + /// ```rust,ignore + /// Options { replace_with: |c| /* … */, ..Options::DEFAULT } + /// ``` + /// + /// … because struct update syntax doesn’t currently allow you to change types, and + /// `Options::DEFAULT` is an `Options>`, but with a closure for `replace_with` + /// you’re needing to change it to `Options<[closure@…]>`. So instead, write like one of these: + /// + /// ```rust,ignore + /// Options::DEFAULT.with_replace_with(|c| /* … */) + /// Options { /* … */, ..Options::DEFAULT }.with_replace_with(|c| /* … */) + /// ``` + /// + /// If you’re using nightly rustc, you can try the [incomplete type-changing-struct-update + /// feature](https://github.com/rust-lang/rust/issues/86555) instead, which lets the first code + /// work (so long as this unstable and incomplete feature is working): + /// + /// ```rust,ignore + /// #![feature(type_changing_struct_update)] + /// use sanitise_file_name::Options; + /// + /// fn main() { + /// Options { replace_with: |c| /* … */, ..Options::DEFAULT } + /// } + /// ``` + pub fn with_replace_with(self, new_replace_with: R2) -> Options { + Options { + length_limit: self.length_limit, + reserve_extra: self.reserve_extra, + extension_cleverness: self.extension_cleverness, + most_fs_safe: self.most_fs_safe, + windows_safe: self.windows_safe, + url_safe: self.url_safe, + normalise_whitespace: self.normalise_whitespace, + trim_spaces_and_full_stops: self.trim_spaces_and_full_stops, + trim_more_punctuation: self.trim_more_punctuation, + remove_control_characters: self.remove_control_characters, + remove_reordering_characters: self.remove_reordering_characters, + replace_with: new_replace_with, + collapse_replacements: self.collapse_replacements, + six_measures_of_barley: self.six_measures_of_barley, + } + } +} + +/// See [`Options::replace_with`]. +pub trait Replace { + // “Why no *string* replacement?” I hear you ask. + // Because then I couldn’t guarantee one allocation. + fn replace(&self, char_being_removed: char) -> Option; +} + +/// `None`: just remove the character, don’t replace it. +/// `Some`: replace the character with this character. +impl Replace for Option { + fn replace(&self, _: char) -> Option { + *self + } +} + +/// Call this function with the character that is being removed, +/// and if it returns a character, replace it with that. +impl Option> Replace for F { + fn replace(&self, c: char) -> Option { + self(c) + } +} + +fn is_most_fs_safe_char(c: char) -> bool { + c != '/' && c != '\0' +} + +fn is_url_safe_char(c: char) -> bool { + // Safe characters are those in the *URL code point* set, minus &, / and ?. + // + // Definitions from the URL and Infra Standards: + // + // > The *URL code points* are ASCII alphanumeric, U+0021 (!), U+0024 ($), U+0026 (&), + // > U+0027 ('), U+0028 LEFT PARENTHESIS, U+0029 RIGHT PARENTHESIS, U+002A (*), U+002B (+), + // > U+002C (,), U+002D (-), U+002E (.), U+002F (/), U+003A (:), U+003B (;), U+003D (=), + // > U+003F (?), U+0040 (@), U+005F (_), U+007E (~), and code points in the range U+00A0 to + // > U+10FFFD, inclusive, excluding surrogates and noncharacters. + // + // > A *noncharacter* is a code point that is in the range U+FDD0 to U+FDEF, inclusive, or + // > U+FFFE, U+FFFF, U+1FFFE, U+1FFFF, U+2FFFE, U+2FFFF, U+3FFFE, U+3FFFF, U+4FFFE, U+4FFFF, + // > U+5FFFE, U+5FFFF, U+6FFFE, U+6FFFF, U+7FFFE, U+7FFFF, U+8FFFE, U+8FFFF, U+9FFFE, U+9FFFF, + // > U+AFFFE, U+AFFFF, U+BFFFE, U+BFFFF, U+CFFFE, U+CFFFF, U+DFFFE, U+DFFFF, U+EFFFE, U+EFFFF, + // > U+FFFFE, U+FFFFF, U+10FFFE, or U+10FFFF. + // + // Surrogates are already excluded by the `char` data type. + + matches!(c, + 'A'..='Z' | 'a'..='z' | '0'..='9' | + '!' | '$' | /* '&' deliberately excluded */ '\'' | '(' | ')' | '*' | '+' | ',' | '-' | + '.' | /* '/' deliberately excluded */ ':' | ';' | '=' | /* '?' deliberately excluded */ + '@' | '_' | '~' | '\u{a0}'..='\u{fdcf}' | '\u{fdf0}'..='\u{10fffd}') + + // Exclude the remaining noncharacters U+??FFFE and U+??FFFF: + && (c as u32) & 0xfffe != 0xfffe +} + +fn is_windows_safe_char(char: char) -> bool { + !matches!(char, + '<' | '>' | ':' | '"' | '/' | '\\' | '|' | '?' | '*' | + '\u{0}'..='\u{1f}' | '\u{7f}') +} + +fn is_space_or_full_stop(c: char) -> bool { + matches!(c, ' ' | '.') +} + +fn is_more_punctuation_character(c: char) -> bool { + matches!(c, '_' | '-' | ',' | ';') +} + +fn is_reordering_character(c: char) -> bool { + matches!(c, '\u{202A}'..='\u{202E}' | '\u{2066}'..='\u{2069}') +} + +fn is_reserved_windows_file_name(name: &str) -> bool { + matches!(name.as_bytes(), + | [b'C' | b'c', b'O' | b'o', b'N' | b'n'] + | [b'P' | b'p', b'R' | b'r', b'N' | b'n'] + | [b'A' | b'a', b'U' | b'u', b'X' | b'x'] + | [b'N' | b'n', b'U' | b'u', b'L' | b'l'] + | [b'C' | b'c', b'O' | b'o', b'M' | b'm', b'1'..=b'9'] + | [b'L' | b'l', b'P' | b'p', b'T' | b't', b'1'..=b'9']) +} + +/// Split a name on its final '.', returning (base name, extension) if there is one. +/// Both could be empty. +fn split_extension(input: &str) -> Option<(&str, &str)> { + input + .as_bytes() + .iter() + .enumerate() + .rev() + .find(|(_, c)| **c == b'.') + .map(|(dot_index, _)| (&input[..dot_index], &input[dot_index + 1..])) +} + +/// Sanitise a file name with the default options. +/// See [`Options`] for a description of what all the options do. +/// +/// The return value should be suitable as a file name, and will not be empty (if it *would* be +/// empty, it’ll be `_` instead, per [`Options::six_measures_of_barley`]’s default). +#[cfg(feature = "alloc")] +#[cfg_attr(docsrs, doc(cfg(feature = "alloc")))] +pub fn sanitise(s: &str) -> String { + sanitise_with_options(s, &Options::DEFAULT) +} + +/// Calculate a sufficient allocation size for the string used. This number will never exceed +/// `input.len() + 1 + options.reserve_extra`, and will be less on ridiculously long inputs. +/// +/// Only intended for use by crazy allocation-counters like me. +pub fn sufficient_alloc_size(input: &str, options: &Options) -> usize { + if options.length_limit < 10 { + return 0; + } + if options.extension_cleverness { + if let Some((base_name, extension)) = split_extension(input) { + let extension_length_limit = options.length_limit - 6; + let might_add_underscore = |n| { + if (n == 3 || n == 4) && options.windows_safe { + n + '_'.len_utf8() + } else { + n + } + }; + return ( + might_add_underscore(base_name.len()).min(options.length_limit) + + '.'.len_utf8() + + extension.len().min(extension_length_limit) + // No reserve_extra on this side because this is the size needed *while working*, + // but reserve_extra is only needed when we’re done. + ).max( + might_add_underscore(input.len()) + .min(options.length_limit) + .max(options.six_measures_of_barley.len()) + + options.reserve_extra + ) + } + } + (input.len().min(options.length_limit) + if options.windows_safe { '_'.len_utf8() } else { 0 }) + .max(options.six_measures_of_barley.len()) + options.reserve_extra +} + +// Alas, ::max isn’t const. +const fn max(a: usize, b: usize) -> usize { if a > b { a } else { b } } + +macro_rules! max_alloc_size_body { + ($options:ident) => {{ + if $options.length_limit < 10 { + return 0; + } + let baseline = max($options.length_limit, $options.six_measures_of_barley.len()) + + $options.reserve_extra; + if $options.extension_cleverness { + let extension_length_limit = $options.length_limit - 6; + max($options.length_limit + '.'.len_utf8() + extension_length_limit, baseline) + } else { + baseline + } + }} +} + +#[cfg(not(feature = "const-fn-trait-bound"))] +/// Calculate the maximum allocation size required for a given set of options, to correctly handle +/// any input. +/// +/// This is intended for the scratch buffer approach, where you keep one string around and keep on +/// sanitising a whole bunch of inputs into it in turn, or for array-allocated strings like with +/// `tinyvec_string`. +/// +/// This is unfortunately not currently a const fn. If you need a const fn (e.g. to craft an +/// precisely-sized `ArrayString`), you may: +/// +/// 1. Enable the `const-fn-trait-bound` feature on this crate (requires nightly rustc), which will +/// change this function to be const, or +/// +/// 2. Use [`max_alloc_size_const`] instead, which requires `R = Option`. +/// (There’s also a `tinyvec_string` usage demonstration there.) +pub fn max_alloc_size(options: &Options) -> usize { + max_alloc_size_body!(options) +} + +#[cfg(feature = "const-fn-trait-bound")] +/// Calculate the maximum allocation size required for a given set of options, to correctly handle +/// any input. +/// +/// This is intended for the scratch buffer approach, where you keep one string around and keep on +/// sanitising a whole bunch of inputs into it in turn, or for array-allocated strings like with +/// `tinyvec_string`. +/// +/// This is a const fn because this crate was compiled with the `const-fn-trait-bound` feature +/// enabled (which requires nightly rustc at the time of writing). +/// +/// See also [`max_alloc_size_const`] for an example of using this with `tinyvec_string`. +pub const fn max_alloc_size(options: &Options) -> usize { + max_alloc_size_body!(options) +} + +/// A `const` variant of [`max_alloc_size`]. +/// +/// Sample usage, combined with `tinyvec_string` (with its `rustc_1_55` feature enabled): +/// +/// ```rust,ignore +/// use tinyvec_string::ArrayString; +/// let mut string = +/// ArrayString::<[u8; max_alloc_size_const(&Options::DEFAULT)]>::new(); +/// sanitise_to("input name", &Options::DEFAULT, &mut string); +/// ``` +/// +/// Once `const-fn-trait-bound` is stabilised, this method will be deprecated. +#[cfg_attr(feature = "const-fn-trait-bound", doc = "\n \ + Since you compiled this crate with the `const-fn-trait-bound` feature, you don’t need this + method. Be cheerful and use `max_alloc_size` instead!")] +pub const fn max_alloc_size_const(options: &Options>) -> usize { + max_alloc_size_body!(options) +} + +/// Sanitise a file name. See [`Options`] for a description of what all the options do. +/// +/// The return value should be suitable as a file name for the specified options, +/// unless it’s empty which can only happen if the option `six_measures_of_barley` is empty (or if +/// the `length_limit` option is illegally small, actually). +#[cfg(feature = "alloc")] +#[cfg_attr(docsrs, doc(cfg(feature = "alloc")))] +pub fn sanitise_with_options(input: &str, options: &Options) -> String { + let mut out = String::with_capacity(sufficient_alloc_size(input, options)); + + #[cfg(test)] + let initial_capacity = out.capacity(); + + sanitise_to(input, options, &mut out); + + #[cfg(test)] + if initial_capacity != out.capacity() { + // I’m serious about this making exactly one allocation. No reallocating allowed. + panic!("Capacity changed from {initial_capacity} to {} (on {:?} → {:?})", + out.capacity(), input, out); + } + + out +} + +/// A target for sanitisation: essentially the subset of `String` functionality used. +/// +/// It might have been nice to use something like `Read + Write + Seek` instead, but the need to +/// delete things after writing means that you need still more, and in the end it’s much easier to +/// treat it as a string. +/// +/// I’ve provided implementations for `String` (if the *alloc* feature is enabled, which it is by +/// default) and `tinyvec_string::ArrayString` (if the *tinyvec_string* feature is enabled), +/// but there’s nothing preventing you from implementing it on other similar string types. +pub trait Stringy: + Index, Output = str> + + Index, Output = str> + + Deref + + Extend +{ + fn push(&mut self, ch: char); + fn push_str(&mut self, string: &str); + fn pop(&mut self) -> Option; + fn truncate(&mut self, new_len: usize); + fn replace_range(&mut self, range: R, replace_with: &str) where R: RangeBounds; +} + +#[cfg(feature = "alloc")] +#[cfg_attr(docsrs, doc(cfg(feature = "alloc")))] +impl Stringy for String { + #[inline] fn push(&mut self, ch: char) { self.push(ch) } + #[inline] fn push_str(&mut self, string: &str) { self.push_str(string) } + #[inline] fn pop(&mut self) -> Option { self.pop() } + #[inline] fn truncate(&mut self, new_len: usize) { self.truncate(new_len) } + #[inline] fn replace_range(&mut self, range: R, replace_with: &str) + where R: RangeBounds + { self.replace_range(range, replace_with) } +} + +#[cfg(feature = "tinyvec_string")] +#[cfg_attr(docsrs, doc(cfg(feature = "tinyvec_string")))] +impl Stringy for tinyvec_string::ArrayString { + #[inline] fn push(&mut self, ch: char) { self.push(ch) } + #[inline] fn push_str(&mut self, string: &str) { self.push_str(string) } + #[inline] fn pop(&mut self) -> Option { self.pop() } + #[inline] fn truncate(&mut self, new_len: usize) { self.truncate(new_len) } + #[inline] fn replace_range(&mut self, range: R, replace_with: &str) + where R: RangeBounds + { self.replace_range(range, replace_with) } +} + +/// Sanitise a file name into an existing `String`. Intended for power users only. +/// +/// When you use [`sanitise`] or [`sanitise_with_options`], the perfect allocation is artisanally +/// crafted (or something). If you use this carelessly, you may actually cause *more* allocations +/// to be made, rather than less. You may therefore wish to use [`sufficient_alloc_size`] in some +/// cases to calculate how much more to reserve ahead of time. +/// +/// See [`Options`] for a description of what all the options do. +/// +/// After calling this, `out` will be the same length or longer, never shorter. If you want to know +/// *how much* longer, store and compare the length yourself. +pub fn sanitise_to(input: &str, options: &Options, out: &mut S) { + let protected = out.len(); + // I said in the docs don’t set it to less than 10, but without this zero leads to some + // unreachable!() being reached, which is æsthetically displeasing, so I’m just going to return + // empty strings for unreasonably small length limits. 🙂 + if options.length_limit < 10 { + return; + } + + // When label-break-value stabilises I’ll switch to that, but until then, loop it is. + #[allow(clippy::never_loop)] + loop { // breaks after exactly one iteration. + if options.extension_cleverness { + if let Some((base_name, extension)) = split_extension(input) { + // With extension-awareness, when the path exceeds length_limit, we prefer + // to truncate from the base name rather than from the extension. But we don’t + // know how much we’ll need to truncate until we’ve finished processing the + // extension, so we have to allocate a maximum of roughly twice as much as + // we’ll end up needing. + // + // For implementation convenience in this corner case, we’ve declared a maximum + // extension length of six less than length_limit (explained on + // Options::extension_cleverness). + let extension_length_limit = options.length_limit - 6; + sanitise_part(base_name, options, options.length_limit, false, out, protected); + let base_len = out.len() - protected; + out.push('.'); + let extension_truncated = sanitise_part( + extension, + options, + extension_length_limit, + true, + out, + // It’s OK for trimming to take out the entire file name (so we’re deliberately + // not including base_len in this), but we mustn’t touch what’s not ours. + protected, + ); + + let mut total_len = out.len() - protected; + + if total_len > options.length_limit { + if extension_truncated { + // Extension is unsalvageable: truncate from the end. + while total_len > options.length_limit { + match out.pop() { + Some(c) => total_len -= c.len_utf8(), + None => unreachable!(), + } + } + // Length is now acceptable, but that could have left us with + // undesirable trailing characters, so run trim again. + out.truncate(protected + trim_end(&out[protected..], options, true).len()); + } else { + // (Sigh. Whose brilliant idea was it to try to preserve extensions anyway? + // Maybe if I’d realised the pain it’d cause I wouldn’t have bothered. + // It’s not like anyone *else* does it. But it is good, say I. And now I’m + // even mulling over grapheme-cluster-aware truncation. Am I mad?) + let base_name_end_index = base_len; + let mut base_chars = out[protected..protected + base_name_end_index].chars(); + while total_len > options.length_limit { + match base_chars.next_back() { + Some(c) => { + total_len -= c.len_utf8(); + } + None => unreachable!(), + } + } + let base_name = trim_end( + &out[protected..protected + base_chars.as_str().len()], + options, + false, + ); + let range = protected + base_name.len()..protected + base_name_end_index; + out.replace_range(range, ""); + } + } + + break; + } + } + // Extension cleverness disabled, or no extension found: the much simpler path! + sanitise_part(input, options, options.length_limit, false, out, protected); + break; + } + + // Finally one last bit of processing: checking names that are all dots + // (though normally windows_safe will already have truncated them to zero). + if (options.url_safe && (&out[protected..] == "." || &out[protected..] == "..")) || + (options.most_fs_safe && out[protected..].chars().all(|c| c == '.')) + { + out.truncate(protected); + } + + if out[protected..].is_empty() { + out.push_str(options.six_measures_of_barley); + } +} + +fn sanitise_part( + input: &str, + options: &Options, + length_limit: usize, + is_extension: bool, + out: &mut S, + protected: usize, +) -> bool { + let mut len = 0; + let mut did_truncate = false; + + let mut last_was_remove = false; + let mut last_was_whitespace = false; + out.extend(input.chars() + .map(|mut c| { + c = if options.normalise_whitespace && c.is_whitespace() { ' ' } else { c }; + (c, + (options.most_fs_safe && !is_most_fs_safe_char(c)) || + (options.windows_safe && !is_windows_safe_char(c)) || + (options.url_safe && !is_url_safe_char(c)) || + (options.remove_control_characters && c.is_control()) || + (options.remove_reordering_characters && is_reordering_character(c)) + ) + }) + .filter_map(|(c, remove)| { + if options.collapse_replacements { + if remove && last_was_remove { + return None; + } + last_was_remove = remove; + } + if remove { options.replace_with.replace(c) } else { Some(c) } + .filter(|&c| { + if options.normalise_whitespace { + let is_whitespace = c == ' '; + let drop = last_was_whitespace && is_whitespace; + last_was_whitespace = is_whitespace; + !drop + } else { + true + } + }) + }) + .skip_while(|&c| { + (options.trim_spaces_and_full_stops && is_space_or_full_stop(c)) || + (options.trim_more_punctuation && is_more_punctuation_character(c)) + }) + .take_while(|&c| { + let new_len = len + c.len_utf8(); + if new_len <= length_limit { + len = new_len; + true + } else { + did_truncate = true; + false + } + }) + ); + + if len > 0 { + // We’ve added something non-trimmed, that’ll guard the potential reserved name underscore. + out.truncate(protected + trim_end(&out[protected..], options, is_extension).len()); + } + + if !is_extension && options.windows_safe && is_reserved_windows_file_name(&out[protected..]) { + // This underscore looks to be in danger of being end-trimmed, + // but in practice we’ve ensured that it won’t be + // (except maybe one case with a lower length_limit than permitted). + out.push('_'); + } + + // Whew. Finally done. Breathe a sigh of relief. + did_truncate +} + +fn trim_end<'a, R: Replace>(out: &'a str, options: &Options, is_extension: bool) -> &'a str { + let trim_space_or_full_stop = options.trim_spaces_and_full_stops || + ((is_extension || !options.extension_cleverness) && options.windows_safe); + out.trim_end_matches(|c| { + (trim_space_or_full_stop && is_space_or_full_stop(c)) || + (options.trim_more_punctuation && is_more_punctuation_character(c)) + }) +} + +// A concession to those poor Americans et al. 😀 +#[cfg(feature = "alloc")] +#[cfg_attr(docsrs, doc(cfg(feature = "alloc")))] +pub use sanitise as sanitize; +#[cfg(feature = "alloc")] +#[cfg_attr(docsrs, doc(cfg(feature = "alloc")))] +pub use sanitise_with_options as sanitize_with_options; +pub use sanitise_to as sanitize_to; + +// How did this get to almost a thousand lines by this point? I’m sure I started out with only +// twenty or so. But then I got careful about allocations, and added extension cleverness, and +// added more features, and documented exhaustingly, and oops, a thousand lines, lines that are +// convoluted at times. Well, I succeeded in all my *functional* goals, with better precision, +// theoretically better but untested speed, better behaviour around extensions, single-allocation +// and even *no*-allocation operation; but utterly lost sight of simple and obviously-correct code. +// Was it worth it? Eh, probably. + +// --- Tests --- + +#[cfg(feature = "alloc")] +#[test] +fn test_length_limit_things() { + // I wrote these tests before I wrote the matrix. I might as well delete them, but I haven’t. + + let short = Options { + length_limit: 10, + ..Options::DEFAULT + }; + + assert_eq!(sanitise_with_options("abcdef.ghij", &short), "abcde.ghij"); + + // Unsalvageable extension + assert_eq!(sanitise_with_options("abcde.fghij", &short), "abcde.fghi"); + + // Windows reserved name protection + assert_eq!(sanitise_with_options("AUX.abcdef", &short), "AUX_.abcd"); + assert_eq!(sanitise_with_options("AUX.abcdef", &Options { windows_safe: false, ..short }), + "AUX.abcd"); + assert_eq!(sanitise_with_options("lpT7.abcdef", &short), "lpT7_.abcd"); + assert_eq!(sanitise_with_options("cOm6.abcdef", &Options { windows_safe: false, ..short }), + "cOm6.abcd"); + + assert_eq!(sanitise("CON"), "CON_"); + assert_eq!(sanitise("aux.h"), "aux_.h"); + assert_eq!(sanitise("Lpt1.exe"), "Lpt1_.exe"); + assert_eq!(sanitise("xyz"), "xyz"); + assert_eq!(sanitise(""), "_"); + assert_eq!(sanitise("nül"), "nül"); + assert_eq!(sanitise("COM1.jpg.png"), "COM1.jpg.png"); +} + +#[cfg(feature = "alloc")] +#[test] +fn matrix() { + // Look, I know I said I didn’t want std, but I *need* it for these tests, y’see? + #[cfg(not(feature = "std"))] + extern crate std; + use std::prelude::rust_2021::*; + use std::fmt::Write; + use std::{eprintln, println, format, vec}; + + fn case< + R: Replace, + #[cfg(feature = "tinyvec_string")] + A: tinyvec_string::bytearray::ByteArray, + >( + set_name: &'static str, + options_name: &'static str, + options: &Options, + paths: &mut Vec, + unsteady_state: &mut Vec<(&'static str, &'static str, String, String, String)>, + // Apparently you can’t do `case::<#[cfg] A>()`, so we have to do this instead. + #[cfg(feature = "tinyvec_string")] + _: std::marker::PhantomData, + ) { + println!("Sanitising {set_name} with options {options_name}"); + #[cfg(feature = "tinyvec_string")] + let mut array_string = tinyvec_string::ArrayString::::new(); + let mut sanitised = String::new(); + let mut capacity = String::new(); + let mut scratch = if options_name == "passthrough" { + // “memory allocation of 18446744073709551615 bytes failed” 😀 + String::new() + } else { + String::with_capacity(max_alloc_size(options) + 1) + }; + let scratch_size = scratch.capacity(); + for input in std::fs::read_to_string(format!("tests/{set_name}.txt")).unwrap().lines() { + let output = sanitise_with_options(input, options); + // A couple of sanity checks make sense here. + if output.len() > options.length_limit { + panic!( + "Input {input} sanitised to {output}, which at {len} is greater than the allowed {max}", + len = output.len(), + max = options.length_limit, + ); + } + if options.windows_safe && is_reserved_windows_file_name( + options.extension_cleverness.then(|| &*output) + .and_then(split_extension) + .map(|(base, _)| base) + .unwrap_or(&output) + ) { + panic!("Input {input} sanitised to {output}, which is a reserved Windows file name"); + } + + // And ensure sanitise_to is working properly also. + scratch.truncate(0); + scratch.push('.'); // A trimmable character, and not six_measures_of_barley. + sanitise_to(input, options, &mut scratch); + assert_eq!(scratch.chars().next(), Some('.')); + assert_eq!(scratch[1..], output); + #[cfg(feature = "tinyvec_string")] + { + if array_string.capacity() > 0 { + array_string.truncate(0); + array_string.push(' '); // A trimmable character, and not six_measures_of_barley. + sanitise_to(input, options, &mut array_string); + assert_eq!(array_string.chars().next(), Some(' ')); + assert_eq!(array_string[1..], output); + } + } + + sanitised.push_str(&output); + sanitised.push('\n'); + let _ = writeln!(capacity, "{}", output.capacity()); + if input != output { + if options_name == "passthrough" { + unsteady_state.push( + (set_name, options_name, input.to_owned(), output.clone(), output), + ); + } else { + let repeated = sanitise_with_options(&output, options); + if repeated != output { + sanitised.push_str("⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠\n"); + sanitised.push_str(&repeated); + sanitised.push('\n'); + unsteady_state.push( + (set_name, options_name, input.to_owned(), output, repeated), + ); + } + } + } + } + let sanitised_name = format!("tests/{set_name}.{options_name}.sanitised"); + let capacity_name = format!("tests/{set_name}.{options_name}.capacity"); + std::fs::write(&sanitised_name, sanitised).unwrap(); + std::fs::write(&capacity_name, capacity).unwrap(); + paths.push(sanitised_name); + paths.push(capacity_name); + if options_name != "passthrough" { + assert_eq!(scratch_size, scratch.capacity(), "scratch buffer reallocated"); + } + } + + let mut unsteady_state = vec![]; + let mut paths = vec![]; + let d = Options::DEFAULT; + for name in ["blns", "misc"] { + macro_rules! case { + // On $array_size: I tried using roughly { max_alloc_size_const(&options) + 1 }, + // but threading it all through was just too painful, especially in the absence of + // const-fn-trait-bound. So I’ll just do one separate test for that. + ($array_size:literal, $options_name:expr, $options:expr) => { + let options = &$options; + // +1 for the ' ' we prefix. + let required_size = max_alloc_size(options).saturating_add(1); + assert!($array_size == 0 || required_size <= $array_size, + "Test case design error: array being given {} bytes, but {} are needed", + $array_size, + required_size + ); + case( + name, + $options_name, + options, + &mut paths, + &mut unsteady_state, + // TODO: after https://github.com/ThatsNoMoon/tinyvec_string/issues/3 is + // resolved, ditch $array_size and use max_alloc_size instead. + #[cfg(feature = "tinyvec_string")] + std::marker::PhantomData::<[u8; $array_size]>, + ); + } + } + // Assumption that I decline to “test” because it’d be silly: + // sanitise(…) == sanitise_with_options(…, &Options::DEFAULT). + case!(512, "default", d); + case!(512, "realistic-length_limit-reduction", Options { length_limit: Options::DEFAULT.length_limit - 4, ..d }); + case!(512, "url_safe", Options { url_safe: true, ..d }); + case!(512, "silly-replace_with", Options::DEFAULT.with_replace_with(|c| char::from_u32(c as u32 + 1))); + case!(512, "no-windows_safe", Options { windows_safe: false, ..d }); + case!(256, "no-extension_cleverness", Options { extension_cleverness: false, ..d }); + // 10 + 1 + case!(11, "short-sans-extension_cleverness", Options { length_limit: 10, extension_cleverness: false, ..d }); + // 15 + 1 + case!(16, "short", Options { length_limit: 10, ..d }); + case!(0, "passthrough", Options { + length_limit: usize::MAX, + reserve_extra: 0, + extension_cleverness: false, + most_fs_safe: false, + windows_safe: false, + url_safe: false, + normalise_whitespace: false, + trim_spaces_and_full_stops: false, + trim_more_punctuation: false, + remove_control_characters: false, + remove_reordering_characters: false, + replace_with: None, + collapse_replacements: false, + six_measures_of_barley: "", + }); + macro_rules! case_only { + ($option:ident) => {{ + let mut options = Options { + most_fs_safe: false, + windows_safe: false, + url_safe: false, + normalise_whitespace: false, + trim_spaces_and_full_stops: false, + trim_more_punctuation: false, + remove_control_characters: false, + remove_reordering_characters: false, + ..d + }; + options.$option = true; + case!(512, concat!("just-", stringify!($option)), options); + }} + } + case_only!(most_fs_safe); + case_only!(windows_safe); + case_only!(url_safe); + case_only!(normalise_whitespace); + case_only!(trim_spaces_and_full_stops); + case_only!(trim_more_punctuation); + case_only!(remove_control_characters); + case_only!(remove_reordering_characters); + // Eh, I’m bored now. That’ll do. + } + + let mut complain_of_unsteady_states = false; + if !unsteady_state.is_empty() { + for (set, options, original, first, second) in &unsteady_state { + match (*set, *options, &**original, &**first, &**second) { + ("blns", "short", "Dr. Herman I. Libshitz", "Dr. Herman", "Dr.Herm") | + ("blns", "short", r#"{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }}"#, "{{ __.__cl", "{{.cl") => { + // Skip known cases of unsalvageable extensions combining with dots in the base + // name to effectively give a new extension, making quiescence take two steps. + // Making these steady-state would take too much effort, and the harm is + // minimal (the unsteady state is still a correctly sanitised name). + }, + (_, "silly-replace_with", _, _, _) => { + // Certainly this one isn’t steady-state! + }, + (_, "passthrough", _, _, _) => { + complain_of_unsteady_states = true; + eprintln!("Unsteady state in {set} with {options} options, diff tests/{set}.{options}.txt and tests/{set}.{options}.sanitised"); + }, + _ => { + complain_of_unsteady_states = true; + eprintln!("Unknown unsteady state in {set} with {options} options, look for the ⚠ symbol in tests/{set}.{options}.sanitised"); + }, + } + } + } + + if !std::process::Command::new("git") + .arg("diff") + .arg("--exit-code") + .arg("--text") + .args(&paths) + .status() + .unwrap() + .success() + { + panic!("sanitisation produced different results than are known, review the diffs"); + } + + // A guard against committing an unsteady state. + if complain_of_unsteady_states { + panic!("Some sanitisations unexpectedly failed to reach a steady state."); + } +} + +#[cfg(feature = "tinyvec_string")] +#[test] +#[should_panic] +fn test_tinyvec_string_panic() { + // I’ve already tested various normal cases, including that ridiculously long strings don’t + // cause overflow on moderately limited arrays with moderate length limits; but I haven’t + // demonstrated the panic that occurs if the array is too short. So here’s this now. 🙂 + sanitise_to( + "Watch me panic!", + &Options::DEFAULT, + &mut tinyvec_string::ArrayString::<[u8; 12]>::new(), + ); +} + +#[cfg(feature = "tinyvec_string")] +#[test] +fn test_tinyvec_string_max_alloc_size() { + use tinyvec_string::ArrayString; + // Note: this is *currently* 505, but I declare that not part of the compatibility contract; + // extension cleverness/grapheme cluster changes could lead to it increasing to 510. + let mut string: ArrayString<[u8; 505]> = + ArrayString::<[u8; max_alloc_size_const(&Options::DEFAULT)]>::new(); + assert_eq!(string.capacity(), 505); + sanitise_to( + "Watch everything being hunky dory, even when I throw unreasonably long values at it all. \ + Even when dots become extension separators; yes, even then. Then further: into the deep \ + reaches of testing, where things start to get garbled, and having written at least 255 \ + characters, I have to now write just as much of extension—horror. But that was a full \ + stop so that this could now be the extension, and I can’t put a dot for the next while› \ + ¿Whatever will I do? I suspect things are getting out of hand here, but I can’t stop now; \ + I’m running out of things to write, but it should be enough by now!", + &Options::DEFAULT, + &mut string, + ); + assert_eq!(string, "Watch everything being hunky dory, even when I throw unreasonably long \ + values at it all. Even when dots become extension separators; yes, even then. Then \ + further_ into the deep reaches of testing, where things start to get garbled, and having \ + written at l"); +} diff --git a/test b/test new file mode 100755 index 0000000..fa24134 --- /dev/null +++ b/test @@ -0,0 +1,16 @@ +#!/bin/sh +set -e +export RUSTFLAGS="-D warnings" +export RUSTDOCFLAGS="-D warnings" +for release in "" "--release"; do + for subcommand in clippy test doc; do + cargo $subcommand $release + cargo $subcommand $release --no-default-features + cargo $subcommand $release --no-default-features --features alloc + cargo $subcommand $release --features tinyvec_string + cargo $subcommand $release --no-default-features --features tinyvec_string,alloc + cargo $subcommand $release --all-features + done +done + +RUSTDOCFLAGS="-D warnings --cfg docsrs" cargo +nightly doc --all-features --no-deps diff --git a/tests/README.md b/tests/README.md new file mode 100644 index 0000000..2519d82 --- /dev/null +++ b/tests/README.md @@ -0,0 +1,8 @@ +Testing is done simply and fairly thoroughly by a big matrix, with `git diff` handling result comparison. + +Each *test-set*.txt, containing one name per line (no testing ␊, sorry), gets sanitised a bunch of times with different sets of options to *test-set*.*options*.sanitised. For good measure, allocation capacities are also recorded to .capacity files. + +---- + +blns.txt comes from https://github.com/minimaxir/big-list-of-naughty-strings at commit 18a88989dabb06077c5740fde3f31fab36355052. +Copyright (c) 2015-2020 Max Woolf, licensed MIT. diff --git a/tests/blns.default.capacity b/tests/blns.default.capacity new file mode 100644 index 0000000..a64f1d6 --- /dev/null +++ b/tests/blns.default.capacity @@ -0,0 +1,742 @@ +19 +2 +46 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +15 +5 +12 +2 +3 +1 +18 +2 +46 +1 +2 +2 +5 +5 +4 +4 +5 +6 +3 +5 +7 +5 +5 +6 +7 +4 +4 +15 +24 +3 +5 +3 +5 +5 +5 +1 +6 +5 +5 +2 +6 +5 +7 +7 +8 +8 +4 +2 +2 +3 +97 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +19 +11 +40 +8 +8 +8 +12 +12 +12 +8 +9 +9 +12 +13 +13 +6 +3 +3 +23 +1 +21 +2 +76 +78 +1 +10 +11 +13 +1 +76 +19 +74 +73 +18 +67 +28 +1 +78 +59 +78 +63 +1 +76 +75 +77 +41 +60 +42 +67 +73 +63 +1 +68 +41 +67 +256 +1 +62 +72 +4 +4 +1 +18 +2 +66 +1 +26 +26 +29 +30 +22 +27 +30 +35 +13 +159 +21 +1 +40 +2 +84 +1 +10 +10 +19 +256 +1 +18 +2 +77 +1 +2 +2 +3 +3 +4 +9 +11 +22 +22 +22 +18 +1 +22 +2 +99 +1 +34 +34 +13 +10 +32 +57 +31 +16 +29 +1 +131 +1 +228 +1 +35 +2 +174 +2 +47 +43 +42 +46 +47 +49 +56 +58 +47 +60 +51 +51 +57 +56 +47 +57 +59 +1 +44 +1 +34 +2 +69 +60 +1 +3 +3 +1 +21 +2 +82 +1 +46 +20 +19 +12 +21 +45 +52 +32 +33 +26 +18 +14 +1 +8 +2 +98 +1 +5 +9 +74 +40 +20 +77 +53 +145 +40 +85 +1 +35 +2 +71 +54 +1 +42 +37 +25 +1 +18 +2 +102 +1 +10 +7 +1 +24 +2 +90 +1 +256 +112 +48 +4 +4 +225 +36 +1 +13 +2 +95 +1 +46 +58 +1 +16 +2 +136 +1 +14 +11 +11 +15 +11 +1 +13 +2 +126 +1 +264 +260 +258 +258 +52 +1 +21 +2 +95 +1 +193 +9 +1 +15 +2 +70 +1 +114 +149 +149 +149 +149 +149 +149 +114 +1 +19 +2 +88 +1 +26 +49 +31 +37 +28 +28 +27 +35 +43 +40 +41 +41 +35 +44 +30 +16 +16 +21 +12 +26 +33 +33 +31 +42 +42 +65 +65 +65 +65 +65 +65 +65 +46 +46 +57 +58 +58 +58 +58 +58 +58 +66 +66 +62 +66 +66 +58 +58 +66 +66 +58 +66 +58 +66 +66 +66 +66 +58 +66 +66 +66 +73 +73 +77 +73 +81 +73 +73 +81 +81 +81 +73 +73 +73 +73 +73 +73 +81 +73 +73 +73 +81 +73 +73 +81 +73 +81 +73 +81 +73 +81 +81 +73 +73 +73 +81 +81 +81 +73 +73 +74 +74 +74 +82 +74 +74 +74 +74 +82 +82 +74 +82 +74 +74 +74 +74 +74 +74 +54 +54 +54 +54 +54 +54 +54 +54 +54 +54 +47 +47 +55 +55 +55 +55 +47 +55 +55 +55 +47 +55 +55 +55 +47 +47 +59 +44 +47 +55 +47 +55 +55 +55 +51 +55 +55 +55 +55 +55 +47 +55 +55 +55 +47 +47 +51 +37 +48 +48 +48 +47 +47 +47 +47 +47 +47 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +47 +47 +47 +47 +47 +49 +48 +48 +48 +48 +48 +48 +81 +58 +54 +69 +94 +51 +56 +38 +38 +41 +57 +39 +38 +33 +137 +218 +126 +41 +43 +43 +43 +63 +46 +54 +51 +50 +35 +44 +30 +35 +48 +19 +31 +43 +12 +17 +39 +1 +16 +2 +70 +1 +19 +25 +14 +12 +45 +2 +2 +2 +1 +24 +2 +125 +1 +2 +3 +10 +7 +6 +38 +22 +23 +34 +1 +27 +2 +72 +1 +27 +19 +11 +23 +14 +15 +1 +27 +2 +84 +1 +138 +1 +25 +2 +256 +1 +6 +13 +3 +11 +4 +5 +3 +3 +9 +1 +17 +2 +90 +1 +46 +42 +1 +33 +2 +46 +1 +44 +58 +21 +8 +1 +34 +2 +57 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +25 +2 +80 +1 +30 +1 +21 +2 +112 +1 +28 +27 +24 +16 +16 +18 +20 +21 +36 +15 +22 +16 +15 +30 +9 +6 +11 +14 +8 +10 +14 +9 +1 +18 +2 +57 +1 +211 +1 +24 +2 +63 +1 +78 +43 +48 +1 +22 +2 +60 +1 +62 +13 +16 +1 +29 +2 +88 +1 +9 +1 +19 +2 +57 +52 +1 +31 +72 diff --git a/tests/blns.default.sanitised b/tests/blns.default.sanitised new file mode 100644 index 0000000..66a1dbc --- /dev/null +++ b/tests/blns.default.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +_ +_ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1_0 +0_0 +2147483648_-1 +9223372036854775808_-1 +0 +0.0 ++0 ++0.0 +0.00 +0.0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +1 +_ +_ +_ +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation.All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +.'[]_-= +{}__+ +!@#$%^&_()`~ +_ +# Non-whitespace C0 controls_ U+0001 through U+0008, U+000E through U+001F +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g.XML) +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. +_ +_ +# Non-whitespace C1 controls_ U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +_ +_ +# Whitespace_ all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL) +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for _trailing whitespace_ in some viewers. +​ +_ +# Unicode additional control characters_ all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏_____⁠⁡⁢⁣⁤____𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹 +_ +# _Byte order marks_, U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g.smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript_Superscript_Accents +# +# Strings which contain unicode subscripts_superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +_ +'' +_ +'_' +''''_' +'_'_'''' +foo val=“bar” +foo val=“bar” +foo val=”bar“ +foo val=`bar' +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters_ can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters_ can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team_ can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit_ https___twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +ﾛ(,_,_) +・(￣∀￣)・ +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +。・___・゜’( ☻ ω ☻ )。・___・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯__(ツ)__¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g.Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر. +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛ ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http___www.unicode.org_charts_PDF_U2000.pdf) +_ +test +test +test +test⁠test +test +_ +# Zalgo Text +# +# Strings which contain _corrupted_ text. The corruption will not appear in non-HTML text, however. (via http___www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an _upsidedown_ effect (via http___www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$ +_ +# Unicode font +# +# Strings which contain bold_italic_etc.versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +script_alert(0)__script +<script>alert('1');<_script> +img src=x onerror=alert(2) +svg__script_123_1_alert(3)__script +script_alert(4)__script +'__script_alert(5)__script +script_alert(6)__script +script__script_alert(7)__script +script __ script _alert(8)_ _ script +onfocus=JaVaSCript_alert(9) autofocus +onfocus=JaVaSCript_alert(10) autofocus +' onfocus=JaVaSCript_alert(11) autofocus +＜script＞alert(12)＜_script＞ +sc_script_ript_alert(13)__sc__script_ript +script_alert(14)__script +alert(15);t= +';alert(16);t=' +JavaSCript_alert(17) +alert(18) +src=JaVaSCript_prompt(19) +script_alert(20);__script x= +'__script_alert(21);__script x=' +script_alert(22);__script x= +autofocus onkeyup=_javascript_alert(23) +' autofocus onkeyup='javascript_alert(24) +script_x20type=_text_javascript__javascript_alert(25);__script +script_x3Etype=_text_javascript__javascript_alert(26);__script +script_x0Dtype=_text_javascript__javascript_alert(27);__script +script_x09type=_text_javascript__javascript_alert(28);__script +script_x0Ctype=_text_javascript__javascript_alert(29);__script +script_x2Ftype=_text_javascript__javascript_alert(30);__script +script_x0Atype=_text_javascript__javascript_alert(31);__script +'`____x3Cscript_javascript_alert(32)__script +'`____x00script_javascript_alert(33)__script +ABC_div style=_x_x3Aexpression(javascript_alert(34)__DEF +ABC_div style=_x_expression_x5C(javascript_alert(35)__DEF +ABC_div style=_x_expression_x00(javascript_alert(36)__DEF +ABC_div style=_x_exp_x00ression(javascript_alert(37)__DEF +ABC_div style=_x_exp_x5Cression(javascript_alert(38)__DEF +ABC_div style=_x__x0Aexpression(javascript_alert(39)__DEF +ABC_div style=_x__x09expression(javascript_alert(40)__DEF +ABC_div style=_x__xE3_x80_x80expression(javascript_alert(41)__DEF +ABC_div style=_x__xE2_x80_x84expression(javascript_alert(42)__DEF +ABC_div style=_x__xC2_xA0expression(javascript_alert(43)__DEF +ABC_div style=_x__xE2_x80_x80expression(javascript_alert(44)__DEF +ABC_div style=_x__xE2_x80_x8Aexpression(javascript_alert(45)__DEF +ABC_div style=_x__x0Dexpression(javascript_alert(46)__DEF +ABC_div style=_x__x0Cexpression(javascript_alert(47)__DEF +ABC_div style=_x__xE2_x80_x87expression(javascript_alert(48)__DEF +ABC_div style=_x__xEF_xBB_xBFexpression(javascript_alert(49)__DEF +ABC_div style=_x__x20expression(javascript_alert(50)__DEF +ABC_div style=_x__xE2_x80_x88expression(javascript_alert(51)__DEF +ABC_div style=_x__x00expression(javascript_alert(52)__DEF +ABC_div style=_x__xE2_x80_x8Bexpression(javascript_alert(53)__DEF +ABC_div style=_x__xE2_x80_x86expression(javascript_alert(54)__DEF +ABC_div style=_x__xE2_x80_x85expression(javascript_alert(55)__DEF +ABC_div style=_x__xE2_x80_x82expression(javascript_alert(56)__DEF +ABC_div style=_x__x0Bexpression(javascript_alert(57)__DEF +ABC_div style=_x__xE2_x80_x81expression(javascript_alert(58)__DEF +ABC_div style=_x__xE2_x80_x83expression(javascript_alert(59)__DEF +ABC_div style=_x__xE2_x80_x89expression(javascript_alert(60)__DEF +a href=__x0Bjavascript_javascript_alert(61)_ id=_fuzzelement1__test__a +a href=__x0Fjavascript_javascript_alert(62)_ id=_fuzzelement1__test__a +a href=__xC2_xA0javascript_javascript_alert(63)_ id=_fuzzelement1__test__a +a href=__x05javascript_javascript_alert(64)_ id=_fuzzelement1__test__a +a href=__xE1_xA0_x8Ejavascript_javascript_alert(65)_ id=_fuzzelement1__test__a +a href=__x18javascript_javascript_alert(66)_ id=_fuzzelement1__test__a +a href=__x11javascript_javascript_alert(67)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x88javascript_javascript_alert(68)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x89javascript_javascript_alert(69)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x80javascript_javascript_alert(70)_ id=_fuzzelement1__test__a +a href=__x17javascript_javascript_alert(71)_ id=_fuzzelement1__test__a +a href=__x03javascript_javascript_alert(72)_ id=_fuzzelement1__test__a +a href=__x0Ejavascript_javascript_alert(73)_ id=_fuzzelement1__test__a +a href=__x1Ajavascript_javascript_alert(74)_ id=_fuzzelement1__test__a +a href=__x00javascript_javascript_alert(75)_ id=_fuzzelement1__test__a +a href=__x10javascript_javascript_alert(76)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x82javascript_javascript_alert(77)_ id=_fuzzelement1__test__a +a href=__x20javascript_javascript_alert(78)_ id=_fuzzelement1__test__a +a href=__x13javascript_javascript_alert(79)_ id=_fuzzelement1__test__a +a href=__x09javascript_javascript_alert(80)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x8Ajavascript_javascript_alert(81)_ id=_fuzzelement1__test__a +a href=__x14javascript_javascript_alert(82)_ id=_fuzzelement1__test__a +a href=__x19javascript_javascript_alert(83)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xAFjavascript_javascript_alert(84)_ id=_fuzzelement1__test__a +a href=__x1Fjavascript_javascript_alert(85)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x81javascript_javascript_alert(86)_ id=_fuzzelement1__test__a +a href=__x1Djavascript_javascript_alert(87)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x87javascript_javascript_alert(88)_ id=_fuzzelement1__test__a +a href=__x07javascript_javascript_alert(89)_ id=_fuzzelement1__test__a +a href=__xE1_x9A_x80javascript_javascript_alert(90)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x83javascript_javascript_alert(91)_ id=_fuzzelement1__test__a +a href=__x04javascript_javascript_alert(92)_ id=_fuzzelement1__test__a +a href=__x01javascript_javascript_alert(93)_ id=_fuzzelement1__test__a +a href=__x08javascript_javascript_alert(94)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x84javascript_javascript_alert(95)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x86javascript_javascript_alert(96)_ id=_fuzzelement1__test__a +a href=__xE3_x80_x80javascript_javascript_alert(97)_ id=_fuzzelement1__test__a +a href=__x12javascript_javascript_alert(98)_ id=_fuzzelement1__test__a +a href=__x0Djavascript_javascript_alert(99)_ id=_fuzzelement1__test__a +a href=__x0Ajavascript_javascript_alert(100)_ id=_fuzzelement1__test__a +a href=__x0Cjavascript_javascript_alert(101)_ id=_fuzzelement1__test__a +a href=__x15javascript_javascript_alert(102)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xA8javascript_javascript_alert(103)_ id=_fuzzelement1__test__a +a href=__x16javascript_javascript_alert(104)_ id=_fuzzelement1__test__a +a href=__x02javascript_javascript_alert(105)_ id=_fuzzelement1__test__a +a href=__x1Bjavascript_javascript_alert(106)_ id=_fuzzelement1__test__a +a href=__x06javascript_javascript_alert(107)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xA9javascript_javascript_alert(108)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x85javascript_javascript_alert(109)_ id=_fuzzelement1__test__a +a href=__x1Ejavascript_javascript_alert(110)_ id=_fuzzelement1__test__a +a href=__xE2_x81_x9Fjavascript_javascript_alert(111)_ id=_fuzzelement1__test__a +a href=__x1Cjavascript_javascript_alert(112)_ id=_fuzzelement1__test__a +a href=_javascript_x00_javascript_alert(113)_ id=_fuzzelement1__test__a +a href=_javascript_x3A_javascript_alert(114)_ id=_fuzzelement1__test__a +a href=_javascript_x09_javascript_alert(115)_ id=_fuzzelement1__test__a +a href=_javascript_x0D_javascript_alert(116)_ id=_fuzzelement1__test__a +a href=_javascript_x0A_javascript_alert(117)_ id=_fuzzelement1__test__a +`_'__img src=xxx_x _x0Aonerror=javascript_alert(118) +`_'__img src=xxx_x _x22onerror=javascript_alert(119) +`_'__img src=xxx_x _x0Bonerror=javascript_alert(120) +`_'__img src=xxx_x _x0Donerror=javascript_alert(121) +`_'__img src=xxx_x _x2Fonerror=javascript_alert(122) +`_'__img src=xxx_x _x09onerror=javascript_alert(123) +`_'__img src=xxx_x _x0Conerror=javascript_alert(124) +`_'__img src=xxx_x _x00onerror=javascript_alert(125) +`_'__img src=xxx_x _x27onerror=javascript_alert(126) +`_'__img src=xxx_x _x20onerror=javascript_alert(127) +`'__script__x3Bjavascript_alert(128)__script +`'__script__x0Djavascript_alert(129)__script +`'__script__xEF_xBB_xBFjavascript_alert(130)__script +`'__script__xE2_x80_x81javascript_alert(131)__script +`'__script__xE2_x80_x84javascript_alert(132)__script +`'__script__xE3_x80_x80javascript_alert(133)__script +`'__script__x09javascript_alert(134)__script +`'__script__xE2_x80_x89javascript_alert(135)__script +`'__script__xE2_x80_x85javascript_alert(136)__script +`'__script__xE2_x80_x88javascript_alert(137)__script +`'__script__x00javascript_alert(138)__script +`'__script__xE2_x80_xA8javascript_alert(139)__script +`'__script__xE2_x80_x8Ajavascript_alert(140)__script +`'__script__xE1_x9A_x80javascript_alert(141)__script +`'__script__x0Cjavascript_alert(142)__script +`'__script__x2Bjavascript_alert(143)__script +`'__script__xF0_x90_x96_x9Ajavascript_alert(144)__script +`'__script_-javascript_alert(145)__script +`'__script__x0Ajavascript_alert(146)__script +`'__script__xE2_x80_xAFjavascript_alert(147)__script +`'__script__x7Ejavascript_alert(148)__script +`'__script__xE2_x80_x87javascript_alert(149)__script +`'__script__xE2_x81_x9Fjavascript_alert(150)__script +`'__script__xE2_x80_xA9javascript_alert(151)__script +`'__script__xC2_x85javascript_alert(152)__script +`'__script__xEF_xBF_xAEjavascript_alert(153)__script +`'__script__xE2_x80_x83javascript_alert(154)__script +`'__script__xE2_x80_x8Bjavascript_alert(155)__script +`'__script__xEF_xBF_xBEjavascript_alert(156)__script +`'__script__xE2_x80_x80javascript_alert(157)__script +`'__script__x21javascript_alert(158)__script +`'__script__xE2_x80_x82javascript_alert(159)__script +`'__script__xE2_x80_x86javascript_alert(160)__script +`'__script__xE1_xA0_x8Ejavascript_alert(161)__script +`'__script__x0Bjavascript_alert(162)__script +`'__script__x20javascript_alert(163)__script +`'__script__xC2_xA0javascript_alert(164)__script +img _x00src=x onerror=_alert(165) +img _x47src=x onerror=_javascript_alert(166) +img _x11src=x onerror=_javascript_alert(167) +img _x12src=x onerror=_javascript_alert(168) +img_x47src=x onerror=_javascript_alert(169) +img_x10src=x onerror=_javascript_alert(170) +img_x13src=x onerror=_javascript_alert(171) +img_x32src=x onerror=_javascript_alert(172) +img_x47src=x onerror=_javascript_alert(173) +img_x11src=x onerror=_javascript_alert(174) +img _x47src=x onerror=_javascript_alert(175) +img _x34src=x onerror=_javascript_alert(176) +img _x39src=x onerror=_javascript_alert(177) +img _x00src=x onerror=_javascript_alert(178) +img src_x09=x onerror=_javascript_alert(179) +img src_x10=x onerror=_javascript_alert(180) +img src_x13=x onerror=_javascript_alert(181) +img src_x32=x onerror=_javascript_alert(182) +img src_x12=x onerror=_javascript_alert(183) +img src_x11=x onerror=_javascript_alert(184) +img src_x00=x onerror=_javascript_alert(185) +img src_x47=x onerror=_javascript_alert(186) +img src=x_x09onerror=_javascript_alert(187) +img src=x_x10onerror=_javascript_alert(188) +img src=x_x11onerror=_javascript_alert(189) +img src=x_x12onerror=_javascript_alert(190) +img src=x_x13onerror=_javascript_alert(191) +img[a][b][c]src[d]=x[e]onerror=[f]_alert(192) +img src=x onerror=_x09_javascript_alert(193) +img src=x onerror=_x10_javascript_alert(194) +img src=x onerror=_x11_javascript_alert(195) +img src=x onerror=_x12_javascript_alert(196) +img src=x onerror=_x32_javascript_alert(197) +img src=x onerror=_x00_javascript_alert(198) +a href=java script_javascript_alert(199)_XXX__a +img src=_x` `_script_javascript_alert(200)__script__` ` +img src onerror __ '_= alt=javascript_alert(201) +title onpropertychange=javascript_alert(202)___title__title title= +a href=http___foo.bar_#x=`y___a__img alt=_`__img src=x_x onerror=javascript_alert(203)___a +!--[if]__script_javascript_alert(204)__script +!--[if_img src=x onerror=javascript_alert(205)__] +script src=___%(jscript)s____script +script src=___%(jscript)s____script +IMG _____SCRIPT_alert(_206_)__SCRIPT +IMG SRC=javascript_alert(String.fromCharCode(50,48,55)) +IMG SRC=# onmouseover=_alert('208') +IMG SRC= onmouseover=_alert('209') +IMG onmouseover=_alert('210') +IMG SRC=javascript:alert('211') +IMG SRC=javascript:alert('212') +IMG SRC=javascript:alert('213') +IMG SRC=_jav ascript_alert('214') +IMG SRC=_jav ascript_alert('215') +IMG SRC=_jav ascript_alert('216') +IMG SRC=_jav ascript_alert('217') +perl -e 'print __IMG SRC=java_0script_alert(__218__)__;' _ out +IMG SRC=_  javascript_alert('219') +SCRIPT_XSS SRC=_http___ha.ckers.org_xss.js____SCRIPT +BODY onload!#$%&()_~+.@[___]^`=alert(_220_) +SCRIPT_SRC=_http___ha.ckers.org_xss.js____SCRIPT +SCRIPT_alert(_221_);_____SCRIPT +SCRIPT SRC=http___ha.ckers.org_xss.js__ B +SCRIPT SRC=__ha.ckers.org.j +IMG SRC=_javascript_alert('222') +iframe src=http___ha.ckers.org_scriptlet.html +alert('223') +u oncopy=alert()_ Copy me__u +i onwheel=alert(224)_ Scroll over me __i +plaintext +http___a_%%30%30 +textarea__script_alert(225)__script +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE _' +_ +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https___news.ycombinator.com_item_id=7665153) +_ +_ +_ +version +help +$USER +dev_null; touch _tmp_blns.fail ; echo +`touch _tmp_blns.fail` +$(touch _tmp_blns.fail) +@{[system _touch _tmp_blns.fail_]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby_Rails applications +_ +eval(_puts 'hello world'_) +System(_ls -al __) +`ls -al _` +Kernel.exec(_ls -al __) +Kernel.exit(1) +%x('ls -al _') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +xml version=_1.0_ encoding=_ISO-8859-1____!DOCTYPE foo [ _!ELEMENT foo ANY __!ENTITY xxe SYSTEM _file____etc_passwd_ _]__foo_&xxe;__foo +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%.s +%@ +%n +File +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +.etc_passwd%00 +.etc_hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch _tmp_blns.shellshock1.fail +() { _; } __[$($())] { touch _tmp_blns.shellshock2.fail; } +%s(un='%s') = %u ++++ATH0 +_ +# MSDOS_Windows Special Filenames +# +# Strings which are reserved characters in MSDOS_Windows +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A +ZZ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https___en.wikipedia.org_wiki_Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http___www.cum.qc.ca +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I.Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat_type on this file +_ +Roses are _[0;31mred_[0m, violets are _[0;34mblue.Hope you enjoy terminal hue +But now..._[20Cfor my greatest trick.[8m +The quic______k brown fo___________x.[Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise _MemoryError_ exception +# second, obviously, prints contents of _etc_passwd +_ +{% print 'x' _ 64 _ 1024__3 %} +{{ __.__class__.__mro__[2].__subclasses__()[40](__etc_passwd_).read() }} diff --git a/tests/blns.just-most_fs_safe.capacity b/tests/blns.just-most_fs_safe.capacity new file mode 100644 index 0000000..0614b7b --- /dev/null +++ b/tests/blns.just-most_fs_safe.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +1 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +1 +17 +1 +45 +1 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +1 +20 +1 +76 +78 +1 +10 +10 +12 +1 +75 +18 +74 +72 +18 +67 +27 +1 +78 +59 +78 +62 +1 +75 +75 +76 +41 +59 +42 +67 +73 +62 +1 +67 +41 +67 +255 +1 +62 +72 +3 +3 +1 +17 +1 +66 +1 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +1 +39 +1 +83 +1 +9 +9 +18 +255 +1 +17 +1 +76 +1 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +1 +21 +1 +98 +1 +33 +33 +12 +9 +31 +56 +30 +15 +28 +1 +130 +1 +227 +1 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +1 +43 +1 +33 +1 +68 +60 +1 +2 +2 +1 +20 +1 +81 +1 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +1 +7 +1 +97 +1 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +1 +34 +1 +70 +53 +1 +41 +36 +24 +1 +17 +1 +101 +1 +9 +6 +1 +23 +1 +90 +1 +256 +111 +47 +3 +3 +224 +35 +1 +12 +1 +95 +1 +45 +57 +1 +15 +1 +136 +1 +13 +10 +10 +14 +10 +1 +12 +1 +126 +1 +264 +260 +258 +258 +51 +1 +20 +1 +95 +1 +192 +8 +1 +14 +1 +70 +1 +113 +148 +148 +148 +148 +148 +148 +113 +1 +18 +1 +87 +1 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +1 +15 +1 +69 +1 +18 +24 +13 +11 +44 +1 +1 +1 +1 +23 +1 +125 +1 +1 +2 +9 +6 +5 +38 +22 +23 +34 +1 +26 +1 +71 +1 +26 +18 +10 +23 +14 +14 +1 +26 +1 +83 +1 +138 +1 +24 +1 +256 +1 +5 +12 +2 +10 +3 +5 +2 +2 +8 +1 +16 +1 +89 +1 +46 +42 +1 +32 +1 +45 +1 +44 +58 +20 +7 +1 +33 +1 +56 +1 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +1 +24 +1 +79 +1 +29 +1 +20 +1 +112 +1 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +1 +17 +1 +56 +1 +211 +1 +23 +1 +62 +1 +78 +43 +48 +1 +21 +1 +59 +1 +61 +12 +15 +1 +28 +1 +87 +1 +8 +1 +18 +1 +56 +51 +1 +30 +72 diff --git a/tests/blns.just-most_fs_safe.sanitised b/tests/blns.just-most_fs_safe.sanitised new file mode 100644 index 0000000..02e1ab7 --- /dev/null +++ b/tests/blns.just-most_fs_safe.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1_2 +-1E2 +-1E02 +-1E+02 +1_0 +0_0 +-2147483648_-1 +-9223372036854775808_-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0..0 +_ +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1#INF +-1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +,._;'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ +_ +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F, +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML), +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. + +_ +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ +_ +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL), +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. + …             ​

  　 +_ +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +_ +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g. smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript_Superscript_Accents +# +# Strings which contain unicode subscripts_superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" + + + + +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters: can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit: https:__twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)__¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر . +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http:__www.unicode.org_charts_PDF_U2000.pdf) +_ +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ +_ +# Zalgo Text +# +# Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http:__www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an "upsidedown" effect (via http:__www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$- +_ +# Unicode font +# +# Strings which contain bold_italic_etc. versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ + +<script>alert('1');</script> + + +"> +'> +> + +< / script >< script >alert(8)< / script > + onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜/script＞ +ript>alert(13)ript> +--> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +;alert(18); +src=JaVaSCript:prompt(19) +">javascript:alert(25); +javascript:alert(26); +javascript:alert(27); +javascript:alert(28); +javascript:alert(29); +javascript:alert(30); +javascript:alert(31); +'`"><\x3Cscript>javascript:alert(32) +'`"><\x00script>javascript:alert(33) +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +ABC
DEF +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +test +`"'> +`"'> +`"'> +`"'> +`"'> +`"'> +`"'> +`"'> +`"'> +`"'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> +"`'> + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +XXX + + + +<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>"> +<!--[if]><script>javascript:alert(204)</script --> +<!--[if<img src=x onerror=javascript:alert(205)//]> --> +<script src="/\%(jscript)s"></script> +<script src="\\%(jscript)s"></script> +<IMG """><SCRIPT>alert("206")</SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="  javascript:alert('219');"> +<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("220")> +<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<<SCRIPT>alert("221");//<</SCRIPT> +<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > +<SCRIPT SRC=//ha.ckers.org/.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http://ha.ckers.org/scriptlet.html < +\";alert('223');// +<u oncopy=alert()> Copy me</u> +<i onwheel=alert(224)> Scroll over me </i> +<plaintext> +http://a/%%30%30 +</textarea><script>alert(225)</script> +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?'; -- + +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) +_ +- +-- +--version +--help +$USER +/dev/null; touch /tmp/blns.fail ; echo +`touch /tmp/blns.fail` +$(touch /tmp/blns.fail) +@{[system "touch /tmp/blns.fail"]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby/Rails applications +_ +eval("puts 'hello world'") +System("ls -al /") +`ls -al /` +Kernel.exec("ls -al /") +Kernel.exit(1) +%x('ls -al /') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File:/// +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +../../../../../../../../../../../etc/passwd%00 +../../../../../../../../../../../etc/hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch /tmp/blns.shellshock1.fail; +() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 +_ +# MSDOS/Windows Special Filenames +# +# Strings which are reserved characters in MSDOS/Windows +_ +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http://www.cum.qc.ca/ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat/type on this file +_ +Roses are red, violets are blue. Hope you enjoy terminal hue +But now...for my greatest trick... +The quick brown fox... [Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of /etc/passwd +_ +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }} diff --git a/tests/blns.just-remove_control_characters.capacity b/tests/blns.just-remove_control_characters.capacity new file mode 100644 index 0000000..0614b7b --- /dev/null +++ b/tests/blns.just-remove_control_characters.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +1 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +1 +17 +1 +45 +1 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +1 +20 +1 +76 +78 +1 +10 +10 +12 +1 +75 +18 +74 +72 +18 +67 +27 +1 +78 +59 +78 +62 +1 +75 +75 +76 +41 +59 +42 +67 +73 +62 +1 +67 +41 +67 +255 +1 +62 +72 +3 +3 +1 +17 +1 +66 +1 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +1 +39 +1 +83 +1 +9 +9 +18 +255 +1 +17 +1 +76 +1 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +1 +21 +1 +98 +1 +33 +33 +12 +9 +31 +56 +30 +15 +28 +1 +130 +1 +227 +1 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +1 +43 +1 +33 +1 +68 +60 +1 +2 +2 +1 +20 +1 +81 +1 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +1 +7 +1 +97 +1 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +1 +34 +1 +70 +53 +1 +41 +36 +24 +1 +17 +1 +101 +1 +9 +6 +1 +23 +1 +90 +1 +256 +111 +47 +3 +3 +224 +35 +1 +12 +1 +95 +1 +45 +57 +1 +15 +1 +136 +1 +13 +10 +10 +14 +10 +1 +12 +1 +126 +1 +264 +260 +258 +258 +51 +1 +20 +1 +95 +1 +192 +8 +1 +14 +1 +70 +1 +113 +148 +148 +148 +148 +148 +148 +113 +1 +18 +1 +87 +1 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +1 +15 +1 +69 +1 +18 +24 +13 +11 +44 +1 +1 +1 +1 +23 +1 +125 +1 +1 +2 +9 +6 +5 +38 +22 +23 +34 +1 +26 +1 +71 +1 +26 +18 +10 +23 +14 +14 +1 +26 +1 +83 +1 +138 +1 +24 +1 +256 +1 +5 +12 +2 +10 +3 +5 +2 +2 +8 +1 +16 +1 +89 +1 +46 +42 +1 +32 +1 +45 +1 +44 +58 +20 +7 +1 +33 +1 +56 +1 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +1 +24 +1 +79 +1 +29 +1 +20 +1 +112 +1 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +1 +17 +1 +56 +1 +211 +1 +23 +1 +62 +1 +78 +43 +48 +1 +21 +1 +59 +1 +61 +12 +15 +1 +28 +1 +87 +1 +8 +1 +18 +1 +56 +51 +1 +30 +72 diff --git a/tests/blns.just-remove_control_characters.sanitised b/tests/blns.just-remove_control_characters.sanitised new file mode 100644 index 0000000..efdc956 --- /dev/null +++ b/tests/blns.just-remove_control_characters.sanitised @@ -0,0 +1,742 @@ +#_Reserved Strings +# +#_Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ +_ +#_Numeric Strings +# +#_Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1/2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1/2 +-1E2 +-1E02 +-1E+02 +1/0 +0/0 +-2147483648/-1 +-9223372036854775808/-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0..0 +. +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0/0 +1.0/0.0 +0.0/0.0 +1,0/0,0 +0,0/0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1#INF +-1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +#_Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +,./;'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ +_ +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F, +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML), +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. +___________________________ +_ +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +_______________________________ +_ +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL), +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. +___ _             ​

  　 +_ +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +_ +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +#_Unicode Symbols +# +#_Strings which contain common unicode symbols (e.g. smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +#_Unicode Subscript/Superscript/Accents +# +#_Strings which contain unicode subscripts/superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +#_Quotation Marks +# +#_Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" +<foo val=“bar” /> +<foo val=“bar” /> +<foo val=”bar“ /> +<foo val=`bar' /> +_ +#_Two-Byte Characters +# +#_Strings which contain two-byte characters: can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +#_Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +#_Special Unicode Characters Union +# +#_A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +#_表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +#_ポ KATAKANA LETTER PO (U+30DD) +#_あ HIRAGANA LETTER A (U+3042) +#_A LATIN CAPITAL LETTER A (U+0041) +#_鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +#_Œ LATIN SMALL LIGATURE OE (U+0153) +#_é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +#_Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +#_逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +#_Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +#_ß LATIN SMALL LETTER SHARP S (U+00DF) +#_ª FEMININE ORDINAL INDICATOR (U+00AA) +#_ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +#_ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +#_丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +#_㐀 CJK Ideograph Extension A, First (U+3400) +#_𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +#_Changing length when lowercased +# +#_Characters which increase in length (2 to 3 bytes) when lowercased +#_Credit: https://twitter.com/jifa/status/625776454479970304 +_ +Ⱥ +Ⱦ +_ +#_Japanese Emoticons +# +#_Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)_/¯ +_ +#_Emoji +# +#_Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +#_Unicode Numbers +# +#_Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +#_Right-To-Left Strings +# +#_Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر . +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +#_Ogham Text +# +#_The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ +_ +#_Trick Unicode +# +#_Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf) +_ +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ +_ +#_Zalgo Text +# +#_Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +#_Unicode Upsidedown +# +#_Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$- +_ +#_Unicode font +# +#_Strings which contain bold/italic/etc. versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +#_Script Injection +# +#_Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +<script>alert(0)</script> +<script>alert('1');</script> +<img src=x onerror=alert(2) /> +<svg><script>123<1>alert(3)</script> +"><script>alert(4)</script> +'><script>alert(5)</script> +><script>alert(6)</script> +</script><script>alert(7)</script> +< / script >< script >alert(8)< / script > + onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜/script＞ +<sc<script>ript>alert(13)</sc</script>ript> +--><script>alert(14)</script> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +;alert(18); +src=JaVaSCript:prompt(19) +"><script>alert(20);</script x=" +'><script>alert(21);</script x=' +><script>alert(22);</script x= +" autofocus onkeyup="javascript:alert(23) +' autofocus onkeyup='javascript:alert(24) +<script\x20type="text/javascript">javascript:alert(25);</script> +<script\x3Etype="text/javascript">javascript:alert(26);</script> +<script\x0Dtype="text/javascript">javascript:alert(27);</script> +<script\x09type="text/javascript">javascript:alert(28);</script> +<script\x0Ctype="text/javascript">javascript:alert(29);</script> +<script\x2Ftype="text/javascript">javascript:alert(30);</script> +<script\x0Atype="text/javascript">javascript:alert(31);</script> +'`"><\x3Cscript>javascript:alert(32)</script> +'`"><\x00script>javascript:alert(33)</script> +ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF +ABC<div style="x:expression\x5C(javascript:alert(35)">DEF +ABC<div style="x:expression\x00(javascript:alert(36)">DEF +ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF +ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF +ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF +ABC<div style="x:\x09expression(javascript:alert(40)">DEF +ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF +ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF +ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF +ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF +ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF +ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF +ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF +ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF +ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF +ABC<div style="x:\x20expression(javascript:alert(50)">DEF +ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF +ABC<div style="x:\x00expression(javascript:alert(52)">DEF +ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF +ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF +ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF +ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF +ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF +ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF +ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF +ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF +<a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test</a> +<a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test</a> +<a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test</a> +<a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test</a> +<a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test</a> +<a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test</a> +<a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test</a> +<a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test</a> +<a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test</a> +<a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test</a> +<a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test</a> +<a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test</a> +<a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test</a> +<a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test</a> +<a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test</a> +<a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test</a> +<a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test</a> +<a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test</a> +<a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test</a> +<a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test</a> +<a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test</a> +<a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test</a> +<a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test</a> +<a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test</a> +<a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test</a> +<a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test</a> +<a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test</a> +<a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test</a> +<a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test</a> +<a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test</a> +<a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test</a> +<a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test</a> +<a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test</a> +<a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test</a> +<a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test</a> +<a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test</a> +<a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test</a> +<a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test</a> +<a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test</a> +<a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test</a> +<a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test</a> +<a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test</a> +<a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test</a> +`"'><img src=xxx:x \x0Aonerror=javascript:alert(118)> +`"'><img src=xxx:x \x22onerror=javascript:alert(119)> +`"'><img src=xxx:x \x0Bonerror=javascript:alert(120)> +`"'><img src=xxx:x \x0Donerror=javascript:alert(121)> +`"'><img src=xxx:x \x2Fonerror=javascript:alert(122)> +`"'><img src=xxx:x \x09onerror=javascript:alert(123)> +`"'><img src=xxx:x \x0Conerror=javascript:alert(124)> +`"'><img src=xxx:x \x00onerror=javascript:alert(125)> +`"'><img src=xxx:x \x27onerror=javascript:alert(126)> +`"'><img src=xxx:x \x20onerror=javascript:alert(127)> +"`'><script>\x3Bjavascript:alert(128)</script> +"`'><script>\x0Djavascript:alert(129)</script> +"`'><script>\xEF\xBB\xBFjavascript:alert(130)</script> +"`'><script>\xE2\x80\x81javascript:alert(131)</script> +"`'><script>\xE2\x80\x84javascript:alert(132)</script> +"`'><script>\xE3\x80\x80javascript:alert(133)</script> +"`'><script>\x09javascript:alert(134)</script> +"`'><script>\xE2\x80\x89javascript:alert(135)</script> +"`'><script>\xE2\x80\x85javascript:alert(136)</script> +"`'><script>\xE2\x80\x88javascript:alert(137)</script> +"`'><script>\x00javascript:alert(138)</script> +"`'><script>\xE2\x80\xA8javascript:alert(139)</script> +"`'><script>\xE2\x80\x8Ajavascript:alert(140)</script> +"`'><script>\xE1\x9A\x80javascript:alert(141)</script> +"`'><script>\x0Cjavascript:alert(142)</script> +"`'><script>\x2Bjavascript:alert(143)</script> +"`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)</script> +"`'><script>-javascript:alert(145)</script> +"`'><script>\x0Ajavascript:alert(146)</script> +"`'><script>\xE2\x80\xAFjavascript:alert(147)</script> +"`'><script>\x7Ejavascript:alert(148)</script> +"`'><script>\xE2\x80\x87javascript:alert(149)</script> +"`'><script>\xE2\x81\x9Fjavascript:alert(150)</script> +"`'><script>\xE2\x80\xA9javascript:alert(151)</script> +"`'><script>\xC2\x85javascript:alert(152)</script> +"`'><script>\xEF\xBF\xAEjavascript:alert(153)</script> +"`'><script>\xE2\x80\x83javascript:alert(154)</script> +"`'><script>\xE2\x80\x8Bjavascript:alert(155)</script> +"`'><script>\xEF\xBF\xBEjavascript:alert(156)</script> +"`'><script>\xE2\x80\x80javascript:alert(157)</script> +"`'><script>\x21javascript:alert(158)</script> +"`'><script>\xE2\x80\x82javascript:alert(159)</script> +"`'><script>\xE2\x80\x86javascript:alert(160)</script> +"`'><script>\xE1\xA0\x8Ejavascript:alert(161)</script> +"`'><script>\x0Bjavascript:alert(162)</script> +"`'><script>\x20javascript:alert(163)</script> +"`'><script>\xC2\xA0javascript:alert(164)</script> +<img \x00src=x onerror="alert(165)"> +<img \x47src=x onerror="javascript:alert(166)"> +<img \x11src=x onerror="javascript:alert(167)"> +<img \x12src=x onerror="javascript:alert(168)"> +<img\x47src=x onerror="javascript:alert(169)"> +<img\x10src=x onerror="javascript:alert(170)"> +<img\x13src=x onerror="javascript:alert(171)"> +<img\x32src=x onerror="javascript:alert(172)"> +<img\x47src=x onerror="javascript:alert(173)"> +<img\x11src=x onerror="javascript:alert(174)"> +<img \x47src=x onerror="javascript:alert(175)"> +<img \x34src=x onerror="javascript:alert(176)"> +<img \x39src=x onerror="javascript:alert(177)"> +<img \x00src=x onerror="javascript:alert(178)"> +<img src\x09=x onerror="javascript:alert(179)"> +<img src\x10=x onerror="javascript:alert(180)"> +<img src\x13=x onerror="javascript:alert(181)"> +<img src\x32=x onerror="javascript:alert(182)"> +<img src\x12=x onerror="javascript:alert(183)"> +<img src\x11=x onerror="javascript:alert(184)"> +<img src\x00=x onerror="javascript:alert(185)"> +<img src\x47=x onerror="javascript:alert(186)"> +<img src=x\x09onerror="javascript:alert(187)"> +<img src=x\x10onerror="javascript:alert(188)"> +<img src=x\x11onerror="javascript:alert(189)"> +<img src=x\x12onerror="javascript:alert(190)"> +<img src=x\x13onerror="javascript:alert(191)"> +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)"> +<img src=x onerror=\x09"javascript:alert(193)"> +<img src=x onerror=\x10"javascript:alert(194)"> +<img src=x onerror=\x11"javascript:alert(195)"> +<img src=x onerror=\x12"javascript:alert(196)"> +<img src=x onerror=\x32"javascript:alert(197)"> +<img src=x onerror=\x00"javascript:alert(198)"> +<a href=java script:javascript:alert(199)>XXX</a> +<img src="x` `<script>javascript:alert(200)</script>"` `> +<img src onerror /" '"= alt=javascript:alert(201)//"> +<title onpropertychange=javascript:alert(202)> +<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>"> +<!--[if]><script>javascript:alert(204)</script --> +<!--[if<img src=x onerror=javascript:alert(205)//]> --> +<script src="/\%(jscript)s"></script> +<script src="\\%(jscript)s"></script> +<IMG """><SCRIPT>alert("206")</SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav   ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="   javascript:alert('219');"> +<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("220")> +<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<<SCRIPT>alert("221");//<</SCRIPT> +<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > +<SCRIPT SRC=//ha.ckers.org/.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http://ha.ckers.org/scriptlet.html < +\";alert('223');// +<u oncopy=alert()> Copy me</u> +<i onwheel=alert(224)> Scroll over me </i> +<plaintext> +http://a/%%30%30 +</textarea><script>alert(225)</script> +_ +#_SQL Injection +# +#_Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?'; -- + +% +_ +_ +#_Server Code Injection +# +#_Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) +_ +- +-- +--version +--help +$USER +/dev/null; touch /tmp/blns.fail ; echo +`touch /tmp/blns.fail` +$(touch /tmp/blns.fail) +@{[system "touch /tmp/blns.fail"]} +_ +#_Command Injection (Ruby) +# +#_Strings which can call system commands within Ruby/Rails applications +_ +eval("puts 'hello world'") +System("ls -al /") +`ls -al /` +Kernel.exec("ls -al /") +Kernel.exit(1) +%x('ls -al /') +_ +# XXE Injection (XML) +# +#_String which can reveal system files when parsed by a badly configured XML parser +_ +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> +_ +#_Unwanted Interpolation +# +#_Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File:/// +_ +#_File Inclusion +# +#_Strings which can cause user to pull in files that should not be a part of a web server +_ +../../../../../../../../../../../etc/passwd%00 +../../../../../../../../../../../etc/hosts +_ +#_Known CVEs and Vulnerabilities +# +#_Strings that test for known vulnerabilities +_ +() { 0; }; touch /tmp/blns.shellshock1.fail; +() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 +_ +#_MSDOS/Windows Special Filenames +# +#_Strings which are reserved characters in MSDOS/Windows +_ +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +#_Scunthorpe Problem +# +#_Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http://www.cum.qc.ca/ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +#_Human injection +# +#_Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +#_Terminal escape codes +# +#_Strings which punish the fools who use cat/type on this file +_ +Roses are _[0;31mred_[0m, violets are _[0;34mblue. Hope you enjoy terminal hue +But now..._[20Cfor my greatest trick..._[8m +The quic______k brown fo___________x... [Beeeep] +_ +#_iOS Vulnerabilities +# +#_Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of /etc/passwd +_ +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }} diff --git a/tests/blns.just-remove_reordering_characters.capacity b/tests/blns.just-remove_reordering_characters.capacity new file mode 100644 index 0000000..0614b7b --- /dev/null +++ b/tests/blns.just-remove_reordering_characters.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +1 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +1 +17 +1 +45 +1 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +1 +20 +1 +76 +78 +1 +10 +10 +12 +1 +75 +18 +74 +72 +18 +67 +27 +1 +78 +59 +78 +62 +1 +75 +75 +76 +41 +59 +42 +67 +73 +62 +1 +67 +41 +67 +255 +1 +62 +72 +3 +3 +1 +17 +1 +66 +1 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +1 +39 +1 +83 +1 +9 +9 +18 +255 +1 +17 +1 +76 +1 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +1 +21 +1 +98 +1 +33 +33 +12 +9 +31 +56 +30 +15 +28 +1 +130 +1 +227 +1 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +1 +43 +1 +33 +1 +68 +60 +1 +2 +2 +1 +20 +1 +81 +1 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +1 +7 +1 +97 +1 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +1 +34 +1 +70 +53 +1 +41 +36 +24 +1 +17 +1 +101 +1 +9 +6 +1 +23 +1 +90 +1 +256 +111 +47 +3 +3 +224 +35 +1 +12 +1 +95 +1 +45 +57 +1 +15 +1 +136 +1 +13 +10 +10 +14 +10 +1 +12 +1 +126 +1 +264 +260 +258 +258 +51 +1 +20 +1 +95 +1 +192 +8 +1 +14 +1 +70 +1 +113 +148 +148 +148 +148 +148 +148 +113 +1 +18 +1 +87 +1 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +1 +15 +1 +69 +1 +18 +24 +13 +11 +44 +1 +1 +1 +1 +23 +1 +125 +1 +1 +2 +9 +6 +5 +38 +22 +23 +34 +1 +26 +1 +71 +1 +26 +18 +10 +23 +14 +14 +1 +26 +1 +83 +1 +138 +1 +24 +1 +256 +1 +5 +12 +2 +10 +3 +5 +2 +2 +8 +1 +16 +1 +89 +1 +46 +42 +1 +32 +1 +45 +1 +44 +58 +20 +7 +1 +33 +1 +56 +1 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +1 +24 +1 +79 +1 +29 +1 +20 +1 +112 +1 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +1 +17 +1 +56 +1 +211 +1 +23 +1 +62 +1 +78 +43 +48 +1 +21 +1 +59 +1 +61 +12 +15 +1 +28 +1 +87 +1 +8 +1 +18 +1 +56 +51 +1 +30 +72 diff --git a/tests/blns.just-remove_reordering_characters.sanitised b/tests/blns.just-remove_reordering_characters.sanitised new file mode 100644 index 0000000..bb3e581 --- /dev/null +++ b/tests/blns.just-remove_reordering_characters.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1/2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1/2 +-1E2 +-1E02 +-1E+02 +1/0 +0/0 +-2147483648/-1 +-9223372036854775808/-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0..0 +. +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0/0 +1.0/0.0 +0.0/0.0 +1,0/0,0 +0,0/0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1#INF +-1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +,./;'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ +_ +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F, +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML), +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. + +_ +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ +_ +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL), +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. + …             ​

  　 +_ +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏_____⁠⁡⁢⁣⁤____𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹 +_ +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g. smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript/Superscript/Accents +# +# Strings which contain unicode subscripts/superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" +<foo val=“bar” /> +<foo val=“bar” /> +<foo val=”bar“ /> +<foo val=`bar' /> +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters: can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit: https://twitter.com/jifa/status/625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)_/¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر . +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf) +_ +__test_ +_test_ +
test
 +test⁠test_ +_test_ +_ +# Zalgo Text +# +# Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$- +_ +# Unicode font +# +# Strings which contain bold/italic/etc. versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +<script>alert(0)</script> +<script>alert('1');</script> +<img src=x onerror=alert(2) /> +<svg><script>123<1>alert(3)</script> +"><script>alert(4)</script> +'><script>alert(5)</script> +><script>alert(6)</script> +</script><script>alert(7)</script> +< / script >< script >alert(8)< / script > + onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜/script＞ +<sc<script>ript>alert(13)</sc</script>ript> +--><script>alert(14)</script> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +;alert(18); +src=JaVaSCript:prompt(19) +"><script>alert(20);</script x=" +'><script>alert(21);</script x=' +><script>alert(22);</script x= +" autofocus onkeyup="javascript:alert(23) +' autofocus onkeyup='javascript:alert(24) +<script\x20type="text/javascript">javascript:alert(25);</script> +<script\x3Etype="text/javascript">javascript:alert(26);</script> +<script\x0Dtype="text/javascript">javascript:alert(27);</script> +<script\x09type="text/javascript">javascript:alert(28);</script> +<script\x0Ctype="text/javascript">javascript:alert(29);</script> +<script\x2Ftype="text/javascript">javascript:alert(30);</script> +<script\x0Atype="text/javascript">javascript:alert(31);</script> +'`"><\x3Cscript>javascript:alert(32)</script> +'`"><\x00script>javascript:alert(33)</script> +ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF +ABC<div style="x:expression\x5C(javascript:alert(35)">DEF +ABC<div style="x:expression\x00(javascript:alert(36)">DEF +ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF +ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF +ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF +ABC<div style="x:\x09expression(javascript:alert(40)">DEF +ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF +ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF +ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF +ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF +ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF +ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF +ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF +ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF +ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF +ABC<div style="x:\x20expression(javascript:alert(50)">DEF +ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF +ABC<div style="x:\x00expression(javascript:alert(52)">DEF +ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF +ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF +ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF +ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF +ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF +ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF +ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF +ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF +<a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test</a> +<a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test</a> +<a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test</a> +<a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test</a> +<a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test</a> +<a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test</a> +<a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test</a> +<a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test</a> +<a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test</a> +<a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test</a> +<a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test</a> +<a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test</a> +<a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test</a> +<a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test</a> +<a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test</a> +<a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test</a> +<a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test</a> +<a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test</a> +<a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test</a> +<a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test</a> +<a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test</a> +<a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test</a> +<a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test</a> +<a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test</a> +<a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test</a> +<a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test</a> +<a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test</a> +<a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test</a> +<a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test</a> +<a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test</a> +<a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test</a> +<a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test</a> +<a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test</a> +<a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test</a> +<a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test</a> +<a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test</a> +<a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test</a> +<a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test</a> +<a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test</a> +<a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test</a> +<a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test</a> +<a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test</a> +<a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test</a> +`"'><img src=xxx:x \x0Aonerror=javascript:alert(118)> +`"'><img src=xxx:x \x22onerror=javascript:alert(119)> +`"'><img src=xxx:x \x0Bonerror=javascript:alert(120)> +`"'><img src=xxx:x \x0Donerror=javascript:alert(121)> +`"'><img src=xxx:x \x2Fonerror=javascript:alert(122)> +`"'><img src=xxx:x \x09onerror=javascript:alert(123)> +`"'><img src=xxx:x \x0Conerror=javascript:alert(124)> +`"'><img src=xxx:x \x00onerror=javascript:alert(125)> +`"'><img src=xxx:x \x27onerror=javascript:alert(126)> +`"'><img src=xxx:x \x20onerror=javascript:alert(127)> +"`'><script>\x3Bjavascript:alert(128)</script> +"`'><script>\x0Djavascript:alert(129)</script> +"`'><script>\xEF\xBB\xBFjavascript:alert(130)</script> +"`'><script>\xE2\x80\x81javascript:alert(131)</script> +"`'><script>\xE2\x80\x84javascript:alert(132)</script> +"`'><script>\xE3\x80\x80javascript:alert(133)</script> +"`'><script>\x09javascript:alert(134)</script> +"`'><script>\xE2\x80\x89javascript:alert(135)</script> +"`'><script>\xE2\x80\x85javascript:alert(136)</script> +"`'><script>\xE2\x80\x88javascript:alert(137)</script> +"`'><script>\x00javascript:alert(138)</script> +"`'><script>\xE2\x80\xA8javascript:alert(139)</script> +"`'><script>\xE2\x80\x8Ajavascript:alert(140)</script> +"`'><script>\xE1\x9A\x80javascript:alert(141)</script> +"`'><script>\x0Cjavascript:alert(142)</script> +"`'><script>\x2Bjavascript:alert(143)</script> +"`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)</script> +"`'><script>-javascript:alert(145)</script> +"`'><script>\x0Ajavascript:alert(146)</script> +"`'><script>\xE2\x80\xAFjavascript:alert(147)</script> +"`'><script>\x7Ejavascript:alert(148)</script> +"`'><script>\xE2\x80\x87javascript:alert(149)</script> +"`'><script>\xE2\x81\x9Fjavascript:alert(150)</script> +"`'><script>\xE2\x80\xA9javascript:alert(151)</script> +"`'><script>\xC2\x85javascript:alert(152)</script> +"`'><script>\xEF\xBF\xAEjavascript:alert(153)</script> +"`'><script>\xE2\x80\x83javascript:alert(154)</script> +"`'><script>\xE2\x80\x8Bjavascript:alert(155)</script> +"`'><script>\xEF\xBF\xBEjavascript:alert(156)</script> +"`'><script>\xE2\x80\x80javascript:alert(157)</script> +"`'><script>\x21javascript:alert(158)</script> +"`'><script>\xE2\x80\x82javascript:alert(159)</script> +"`'><script>\xE2\x80\x86javascript:alert(160)</script> +"`'><script>\xE1\xA0\x8Ejavascript:alert(161)</script> +"`'><script>\x0Bjavascript:alert(162)</script> +"`'><script>\x20javascript:alert(163)</script> +"`'><script>\xC2\xA0javascript:alert(164)</script> +<img \x00src=x onerror="alert(165)"> +<img \x47src=x onerror="javascript:alert(166)"> +<img \x11src=x onerror="javascript:alert(167)"> +<img \x12src=x onerror="javascript:alert(168)"> +<img\x47src=x onerror="javascript:alert(169)"> +<img\x10src=x onerror="javascript:alert(170)"> +<img\x13src=x onerror="javascript:alert(171)"> +<img\x32src=x onerror="javascript:alert(172)"> +<img\x47src=x onerror="javascript:alert(173)"> +<img\x11src=x onerror="javascript:alert(174)"> +<img \x47src=x onerror="javascript:alert(175)"> +<img \x34src=x onerror="javascript:alert(176)"> +<img \x39src=x onerror="javascript:alert(177)"> +<img \x00src=x onerror="javascript:alert(178)"> +<img src\x09=x onerror="javascript:alert(179)"> +<img src\x10=x onerror="javascript:alert(180)"> +<img src\x13=x onerror="javascript:alert(181)"> +<img src\x32=x onerror="javascript:alert(182)"> +<img src\x12=x onerror="javascript:alert(183)"> +<img src\x11=x onerror="javascript:alert(184)"> +<img src\x00=x onerror="javascript:alert(185)"> +<img src\x47=x onerror="javascript:alert(186)"> +<img src=x\x09onerror="javascript:alert(187)"> +<img src=x\x10onerror="javascript:alert(188)"> +<img src=x\x11onerror="javascript:alert(189)"> +<img src=x\x12onerror="javascript:alert(190)"> +<img src=x\x13onerror="javascript:alert(191)"> +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)"> +<img src=x onerror=\x09"javascript:alert(193)"> +<img src=x onerror=\x10"javascript:alert(194)"> +<img src=x onerror=\x11"javascript:alert(195)"> +<img src=x onerror=\x12"javascript:alert(196)"> +<img src=x onerror=\x32"javascript:alert(197)"> +<img src=x onerror=\x00"javascript:alert(198)"> +<a href=java script:javascript:alert(199)>XXX</a> +<img src="x` `<script>javascript:alert(200)</script>"` `> +<img src onerror /" '"= alt=javascript:alert(201)//"> +<title onpropertychange=javascript:alert(202)> +<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>"> +<!--[if]><script>javascript:alert(204)</script --> +<!--[if<img src=x onerror=javascript:alert(205)//]> --> +<script src="/\%(jscript)s"></script> +<script src="\\%(jscript)s"></script> +<IMG """><SCRIPT>alert("206")</SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav   ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="   javascript:alert('219');"> +<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("220")> +<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<<SCRIPT>alert("221");//<</SCRIPT> +<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > +<SCRIPT SRC=//ha.ckers.org/.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http://ha.ckers.org/scriptlet.html < +\";alert('223');// +<u oncopy=alert()> Copy me</u> +<i onwheel=alert(224)> Scroll over me </i> +<plaintext> +http://a/%%30%30 +</textarea><script>alert(225)</script> +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?'; -- + +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) +_ +- +-- +--version +--help +$USER +/dev/null; touch /tmp/blns.fail ; echo +`touch /tmp/blns.fail` +$(touch /tmp/blns.fail) +@{[system "touch /tmp/blns.fail"]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby/Rails applications +_ +eval("puts 'hello world'") +System("ls -al /") +`ls -al /` +Kernel.exec("ls -al /") +Kernel.exit(1) +%x('ls -al /') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File:/// +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +../../../../../../../../../../../etc/passwd%00 +../../../../../../../../../../../etc/hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch /tmp/blns.shellshock1.fail; +() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 +_ +# MSDOS/Windows Special Filenames +# +# Strings which are reserved characters in MSDOS/Windows +_ +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http://www.cum.qc.ca/ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat/type on this file +_ +Roses are red, violets are blue. Hope you enjoy terminal hue +But now...for my greatest trick... +The quick brown fox... [Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of /etc/passwd +_ +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }} diff --git a/tests/blns.just-trim_more_punctuation.capacity b/tests/blns.just-trim_more_punctuation.capacity new file mode 100644 index 0000000..0614b7b --- /dev/null +++ b/tests/blns.just-trim_more_punctuation.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +1 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +1 +17 +1 +45 +1 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +1 +20 +1 +76 +78 +1 +10 +10 +12 +1 +75 +18 +74 +72 +18 +67 +27 +1 +78 +59 +78 +62 +1 +75 +75 +76 +41 +59 +42 +67 +73 +62 +1 +67 +41 +67 +255 +1 +62 +72 +3 +3 +1 +17 +1 +66 +1 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +1 +39 +1 +83 +1 +9 +9 +18 +255 +1 +17 +1 +76 +1 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +1 +21 +1 +98 +1 +33 +33 +12 +9 +31 +56 +30 +15 +28 +1 +130 +1 +227 +1 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +1 +43 +1 +33 +1 +68 +60 +1 +2 +2 +1 +20 +1 +81 +1 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +1 +7 +1 +97 +1 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +1 +34 +1 +70 +53 +1 +41 +36 +24 +1 +17 +1 +101 +1 +9 +6 +1 +23 +1 +90 +1 +256 +111 +47 +3 +3 +224 +35 +1 +12 +1 +95 +1 +45 +57 +1 +15 +1 +136 +1 +13 +10 +10 +14 +10 +1 +12 +1 +126 +1 +264 +260 +258 +258 +51 +1 +20 +1 +95 +1 +192 +8 +1 +14 +1 +70 +1 +113 +148 +148 +148 +148 +148 +148 +113 +1 +18 +1 +87 +1 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +1 +15 +1 +69 +1 +18 +24 +13 +11 +44 +1 +1 +1 +1 +23 +1 +125 +1 +1 +2 +9 +6 +5 +38 +22 +23 +34 +1 +26 +1 +71 +1 +26 +18 +10 +23 +14 +14 +1 +26 +1 +83 +1 +138 +1 +24 +1 +256 +1 +5 +12 +2 +10 +3 +5 +2 +2 +8 +1 +16 +1 +89 +1 +46 +42 +1 +32 +1 +45 +1 +44 +58 +20 +7 +1 +33 +1 +56 +1 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +1 +24 +1 +79 +1 +29 +1 +20 +1 +112 +1 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +1 +17 +1 +56 +1 +211 +1 +23 +1 +62 +1 +78 +43 +48 +1 +21 +1 +59 +1 +61 +12 +15 +1 +28 +1 +87 +1 +8 +1 +18 +1 +56 +51 +1 +30 +72 diff --git a/tests/blns.just-trim_more_punctuation.sanitised b/tests/blns.just-trim_more_punctuation.sanitised new file mode 100644 index 0000000..62f0e2f --- /dev/null +++ b/tests/blns.just-trim_more_punctuation.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1/2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1/2 +1E2 +1E02 +1E+02 +1/0 +0/0 +2147483648/-1 +9223372036854775808/-1 +0 +0.0 ++0 ++0.0 +0.00 +0..0 +. +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0/0 +1.0/0.0 +0.0/0.0 +1,0/0,0 +0,0/0,0 +1 +_ +. +_ +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +./;'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ +_ +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML) +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. + +_ +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ +_ +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL) +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. + …             ​

  　 +_ +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +_ +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g. smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript/Superscript/Accents +# +# Strings which contain unicode subscripts/superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" +<foo val=“bar” /> +<foo val=“bar” /> +<foo val=”bar“ /> +<foo val=`bar' /> +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters: can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit: https://twitter.com/jifa/status/625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)_/¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر . +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf) +_ +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ +_ +# Zalgo Text +# +# Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$ +_ +# Unicode font +# +# Strings which contain bold/italic/etc. versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +<script>alert(0)</script> +<script>alert('1');</script> +<img src=x onerror=alert(2) /> +<svg><script>123<1>alert(3)</script> +"><script>alert(4)</script> +'><script>alert(5)</script> +><script>alert(6)</script> +</script><script>alert(7)</script> +< / script >< script >alert(8)< / script > + onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜/script＞ +<sc<script>ript>alert(13)</sc</script>ript> +><script>alert(14)</script> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +alert(18) +src=JaVaSCript:prompt(19) +"><script>alert(20);</script x=" +'><script>alert(21);</script x=' +><script>alert(22);</script x= +" autofocus onkeyup="javascript:alert(23) +' autofocus onkeyup='javascript:alert(24) +<script\x20type="text/javascript">javascript:alert(25);</script> +<script\x3Etype="text/javascript">javascript:alert(26);</script> +<script\x0Dtype="text/javascript">javascript:alert(27);</script> +<script\x09type="text/javascript">javascript:alert(28);</script> +<script\x0Ctype="text/javascript">javascript:alert(29);</script> +<script\x2Ftype="text/javascript">javascript:alert(30);</script> +<script\x0Atype="text/javascript">javascript:alert(31);</script> +'`"><\x3Cscript>javascript:alert(32)</script> +'`"><\x00script>javascript:alert(33)</script> +ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF +ABC<div style="x:expression\x5C(javascript:alert(35)">DEF +ABC<div style="x:expression\x00(javascript:alert(36)">DEF +ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF +ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF +ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF +ABC<div style="x:\x09expression(javascript:alert(40)">DEF +ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF +ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF +ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF +ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF +ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF +ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF +ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF +ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF +ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF +ABC<div style="x:\x20expression(javascript:alert(50)">DEF +ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF +ABC<div style="x:\x00expression(javascript:alert(52)">DEF +ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF +ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF +ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF +ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF +ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF +ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF +ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF +ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF +<a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test</a> +<a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test</a> +<a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test</a> +<a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test</a> +<a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test</a> +<a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test</a> +<a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test</a> +<a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test</a> +<a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test</a> +<a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test</a> +<a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test</a> +<a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test</a> +<a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test</a> +<a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test</a> +<a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test</a> +<a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test</a> +<a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test</a> +<a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test</a> +<a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test</a> +<a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test</a> +<a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test</a> +<a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test</a> +<a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test</a> +<a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test</a> +<a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test</a> +<a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test</a> +<a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test</a> +<a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test</a> +<a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test</a> +<a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test</a> +<a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test</a> +<a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test</a> +<a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test</a> +<a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test</a> +<a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test</a> +<a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test</a> +<a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test</a> +<a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test</a> +<a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test</a> +<a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test</a> +<a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test</a> +<a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test</a> +<a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test</a> +`"'><img src=xxx:x \x0Aonerror=javascript:alert(118)> +`"'><img src=xxx:x \x22onerror=javascript:alert(119)> +`"'><img src=xxx:x \x0Bonerror=javascript:alert(120)> +`"'><img src=xxx:x \x0Donerror=javascript:alert(121)> +`"'><img src=xxx:x \x2Fonerror=javascript:alert(122)> +`"'><img src=xxx:x \x09onerror=javascript:alert(123)> +`"'><img src=xxx:x \x0Conerror=javascript:alert(124)> +`"'><img src=xxx:x \x00onerror=javascript:alert(125)> +`"'><img src=xxx:x \x27onerror=javascript:alert(126)> +`"'><img src=xxx:x \x20onerror=javascript:alert(127)> +"`'><script>\x3Bjavascript:alert(128)</script> +"`'><script>\x0Djavascript:alert(129)</script> +"`'><script>\xEF\xBB\xBFjavascript:alert(130)</script> +"`'><script>\xE2\x80\x81javascript:alert(131)</script> +"`'><script>\xE2\x80\x84javascript:alert(132)</script> +"`'><script>\xE3\x80\x80javascript:alert(133)</script> +"`'><script>\x09javascript:alert(134)</script> +"`'><script>\xE2\x80\x89javascript:alert(135)</script> +"`'><script>\xE2\x80\x85javascript:alert(136)</script> +"`'><script>\xE2\x80\x88javascript:alert(137)</script> +"`'><script>\x00javascript:alert(138)</script> +"`'><script>\xE2\x80\xA8javascript:alert(139)</script> +"`'><script>\xE2\x80\x8Ajavascript:alert(140)</script> +"`'><script>\xE1\x9A\x80javascript:alert(141)</script> +"`'><script>\x0Cjavascript:alert(142)</script> +"`'><script>\x2Bjavascript:alert(143)</script> +"`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)</script> +"`'><script>-javascript:alert(145)</script> +"`'><script>\x0Ajavascript:alert(146)</script> +"`'><script>\xE2\x80\xAFjavascript:alert(147)</script> +"`'><script>\x7Ejavascript:alert(148)</script> +"`'><script>\xE2\x80\x87javascript:alert(149)</script> +"`'><script>\xE2\x81\x9Fjavascript:alert(150)</script> +"`'><script>\xE2\x80\xA9javascript:alert(151)</script> +"`'><script>\xC2\x85javascript:alert(152)</script> +"`'><script>\xEF\xBF\xAEjavascript:alert(153)</script> +"`'><script>\xE2\x80\x83javascript:alert(154)</script> +"`'><script>\xE2\x80\x8Bjavascript:alert(155)</script> +"`'><script>\xEF\xBF\xBEjavascript:alert(156)</script> +"`'><script>\xE2\x80\x80javascript:alert(157)</script> +"`'><script>\x21javascript:alert(158)</script> +"`'><script>\xE2\x80\x82javascript:alert(159)</script> +"`'><script>\xE2\x80\x86javascript:alert(160)</script> +"`'><script>\xE1\xA0\x8Ejavascript:alert(161)</script> +"`'><script>\x0Bjavascript:alert(162)</script> +"`'><script>\x20javascript:alert(163)</script> +"`'><script>\xC2\xA0javascript:alert(164)</script> +<img \x00src=x onerror="alert(165)"> +<img \x47src=x onerror="javascript:alert(166)"> +<img \x11src=x onerror="javascript:alert(167)"> +<img \x12src=x onerror="javascript:alert(168)"> +<img\x47src=x onerror="javascript:alert(169)"> +<img\x10src=x onerror="javascript:alert(170)"> +<img\x13src=x onerror="javascript:alert(171)"> +<img\x32src=x onerror="javascript:alert(172)"> +<img\x47src=x onerror="javascript:alert(173)"> +<img\x11src=x onerror="javascript:alert(174)"> +<img \x47src=x onerror="javascript:alert(175)"> +<img \x34src=x onerror="javascript:alert(176)"> +<img \x39src=x onerror="javascript:alert(177)"> +<img \x00src=x onerror="javascript:alert(178)"> +<img src\x09=x onerror="javascript:alert(179)"> +<img src\x10=x onerror="javascript:alert(180)"> +<img src\x13=x onerror="javascript:alert(181)"> +<img src\x32=x onerror="javascript:alert(182)"> +<img src\x12=x onerror="javascript:alert(183)"> +<img src\x11=x onerror="javascript:alert(184)"> +<img src\x00=x onerror="javascript:alert(185)"> +<img src\x47=x onerror="javascript:alert(186)"> +<img src=x\x09onerror="javascript:alert(187)"> +<img src=x\x10onerror="javascript:alert(188)"> +<img src=x\x11onerror="javascript:alert(189)"> +<img src=x\x12onerror="javascript:alert(190)"> +<img src=x\x13onerror="javascript:alert(191)"> +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)"> +<img src=x onerror=\x09"javascript:alert(193)"> +<img src=x onerror=\x10"javascript:alert(194)"> +<img src=x onerror=\x11"javascript:alert(195)"> +<img src=x onerror=\x12"javascript:alert(196)"> +<img src=x onerror=\x32"javascript:alert(197)"> +<img src=x onerror=\x00"javascript:alert(198)"> +<a href=java script:javascript:alert(199)>XXX</a> +<img src="x` `<script>javascript:alert(200)</script>"` `> +<img src onerror /" '"= alt=javascript:alert(201)//"> +<title onpropertychange=javascript:alert(202)> +<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>"> +<!--[if]><script>javascript:alert(204)</script --> +<!--[if<img src=x onerror=javascript:alert(205)//]> --> +<script src="/\%(jscript)s"></script> +<script src="\\%(jscript)s"></script> +<IMG """><SCRIPT>alert("206")</SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav   ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="   javascript:alert('219');"> +<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<BODY onload!#$%&()*~+.:;?@[/|\]^`=alert("220")> +<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<<SCRIPT>alert("221");//<</SCRIPT> +<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > +<SCRIPT SRC=//ha.ckers.org/.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http://ha.ckers.org/scriptlet.html < +\";alert('223');// +<u oncopy=alert()> Copy me</u> +<i onwheel=alert(224)> Scroll over me </i> +<plaintext> +http://a/%%30%30 +</textarea><script>alert(225)</script> +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?'; + +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) +_ +_ +_ +version +help +$USER +/dev/null; touch /tmp/blns.fail ; echo +`touch /tmp/blns.fail` +$(touch /tmp/blns.fail) +@{[system "touch /tmp/blns.fail"]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby/Rails applications +_ +eval("puts 'hello world'") +System("ls -al /") +`ls -al /` +Kernel.exec("ls -al /") +Kernel.exit(1) +%x('ls -al /') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File:/// +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +../../../../../../../../../../../etc/passwd%00 +../../../../../../../../../../../etc/hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch /tmp/blns.shellshock1.fail +() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 +_ +# MSDOS/Windows Special Filenames +# +# Strings which are reserved characters in MSDOS/Windows +_ +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http://www.cum.qc.ca/ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat/type on this file +_ +Roses are red, violets are blue. Hope you enjoy terminal hue +But now...for my greatest trick... +The quick brown fox... [Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of /etc/passwd +_ +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }} diff --git a/tests/blns.just-trim_spaces_and_full_stops.capacity b/tests/blns.just-trim_spaces_and_full_stops.capacity new file mode 100644 index 0000000..0614b7b --- /dev/null +++ b/tests/blns.just-trim_spaces_and_full_stops.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +1 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +1 +17 +1 +45 +1 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +1 +20 +1 +76 +78 +1 +10 +10 +12 +1 +75 +18 +74 +72 +18 +67 +27 +1 +78 +59 +78 +62 +1 +75 +75 +76 +41 +59 +42 +67 +73 +62 +1 +67 +41 +67 +255 +1 +62 +72 +3 +3 +1 +17 +1 +66 +1 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +1 +39 +1 +83 +1 +9 +9 +18 +255 +1 +17 +1 +76 +1 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +1 +21 +1 +98 +1 +33 +33 +12 +9 +31 +56 +30 +15 +28 +1 +130 +1 +227 +1 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +1 +43 +1 +33 +1 +68 +60 +1 +2 +2 +1 +20 +1 +81 +1 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +1 +7 +1 +97 +1 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +1 +34 +1 +70 +53 +1 +41 +36 +24 +1 +17 +1 +101 +1 +9 +6 +1 +23 +1 +90 +1 +256 +111 +47 +3 +3 +224 +35 +1 +12 +1 +95 +1 +45 +57 +1 +15 +1 +136 +1 +13 +10 +10 +14 +10 +1 +12 +1 +126 +1 +264 +260 +258 +258 +51 +1 +20 +1 +95 +1 +192 +8 +1 +14 +1 +70 +1 +113 +148 +148 +148 +148 +148 +148 +113 +1 +18 +1 +87 +1 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +1 +15 +1 +69 +1 +18 +24 +13 +11 +44 +1 +1 +1 +1 +23 +1 +125 +1 +1 +2 +9 +6 +5 +38 +22 +23 +34 +1 +26 +1 +71 +1 +26 +18 +10 +23 +14 +14 +1 +26 +1 +83 +1 +138 +1 +24 +1 +256 +1 +5 +12 +2 +10 +3 +5 +2 +2 +8 +1 +16 +1 +89 +1 +46 +42 +1 +32 +1 +45 +1 +44 +58 +20 +7 +1 +33 +1 +56 +1 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +1 +24 +1 +79 +1 +29 +1 +20 +1 +112 +1 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +1 +17 +1 +56 +1 +211 +1 +23 +1 +62 +1 +78 +43 +48 +1 +21 +1 +59 +1 +61 +12 +15 +1 +28 +1 +87 +1 +8 +1 +18 +1 +56 +51 +1 +30 +72 diff --git a/tests/blns.just-trim_spaces_and_full_stops.sanitised b/tests/blns.just-trim_spaces_and_full_stops.sanitised new file mode 100644 index 0000000..b1fd281 --- /dev/null +++ b/tests/blns.just-trim_spaces_and_full_stops.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1/2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1/2 +-1E2 +-1E02 +-1E+02 +1/0 +0/0 +-2147483648/-1 +-9223372036854775808/-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0.0 +. +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0/0 +1.0/0.0 +0.0/0.0 +1,0/0,0 +0,0/0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1#INF +-1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation.All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +,./;'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ +_ +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F, +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g.XML), +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. + +_ +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ +_ +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL), +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. + …             ​

  　 +_ +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +_ +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g.smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript/Superscript/Accents +# +# Strings which contain unicode subscripts/superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" +<foo val=“bar” /> +<foo val=“bar” /> +<foo val=”bar“ /> +<foo val=`bar' /> +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters: can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit: https://twitter.com/jifa/status/625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)_/¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g.Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر. +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf) +_ +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ +_ +# Zalgo Text +# +# Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$- +_ +# Unicode font +# +# Strings which contain bold/italic/etc.versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +<script>alert(0)</script> +<script>alert('1');</script> +<img src=x onerror=alert(2) /> +<svg><script>123<1>alert(3)</script> +"><script>alert(4)</script> +'><script>alert(5)</script> +><script>alert(6)</script> +</script><script>alert(7)</script> +< / script >< script >alert(8)< / script > + onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜/script＞ +<sc<script>ript>alert(13)</sc</script>ript> +--><script>alert(14)</script> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +;alert(18); +src=JaVaSCript:prompt(19) +"><script>alert(20);</script x=" +'><script>alert(21);</script x=' +><script>alert(22);</script x= +" autofocus onkeyup="javascript:alert(23) +' autofocus onkeyup='javascript:alert(24) +<script\x20type="text/javascript">javascript:alert(25);</script> +<script\x3Etype="text/javascript">javascript:alert(26);</script> +<script\x0Dtype="text/javascript">javascript:alert(27);</script> +<script\x09type="text/javascript">javascript:alert(28);</script> +<script\x0Ctype="text/javascript">javascript:alert(29);</script> +<script\x2Ftype="text/javascript">javascript:alert(30);</script> +<script\x0Atype="text/javascript">javascript:alert(31);</script> +'`"><\x3Cscript>javascript:alert(32)</script> +'`"><\x00script>javascript:alert(33)</script> +ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF +ABC<div style="x:expression\x5C(javascript:alert(35)">DEF +ABC<div style="x:expression\x00(javascript:alert(36)">DEF +ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF +ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF +ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF +ABC<div style="x:\x09expression(javascript:alert(40)">DEF +ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF +ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF +ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF +ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF +ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF +ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF +ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF +ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF +ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF +ABC<div style="x:\x20expression(javascript:alert(50)">DEF +ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF +ABC<div style="x:\x00expression(javascript:alert(52)">DEF +ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF +ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF +ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF +ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF +ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF +ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF +ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF +ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF +<a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test</a> +<a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test</a> +<a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test</a> +<a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test</a> +<a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test</a> +<a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test</a> +<a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test</a> +<a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test</a> +<a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test</a> +<a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test</a> +<a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test</a> +<a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test</a> +<a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test</a> +<a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test</a> +<a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test</a> +<a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test</a> +<a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test</a> +<a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test</a> +<a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test</a> +<a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test</a> +<a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test</a> +<a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test</a> +<a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test</a> +<a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test</a> +<a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test</a> +<a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test</a> +<a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test</a> +<a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test</a> +<a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test</a> +<a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test</a> +<a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test</a> +<a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test</a> +<a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test</a> +<a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test</a> +<a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test</a> +<a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test</a> +<a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test</a> +<a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test</a> +<a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test</a> +<a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test</a> +<a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test</a> +<a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test</a> +<a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test</a> +`"'><img src=xxx:x \x0Aonerror=javascript:alert(118)> +`"'><img src=xxx:x \x22onerror=javascript:alert(119)> +`"'><img src=xxx:x \x0Bonerror=javascript:alert(120)> +`"'><img src=xxx:x \x0Donerror=javascript:alert(121)> +`"'><img src=xxx:x \x2Fonerror=javascript:alert(122)> +`"'><img src=xxx:x \x09onerror=javascript:alert(123)> +`"'><img src=xxx:x \x0Conerror=javascript:alert(124)> +`"'><img src=xxx:x \x00onerror=javascript:alert(125)> +`"'><img src=xxx:x \x27onerror=javascript:alert(126)> +`"'><img src=xxx:x \x20onerror=javascript:alert(127)> +"`'><script>\x3Bjavascript:alert(128)</script> +"`'><script>\x0Djavascript:alert(129)</script> +"`'><script>\xEF\xBB\xBFjavascript:alert(130)</script> +"`'><script>\xE2\x80\x81javascript:alert(131)</script> +"`'><script>\xE2\x80\x84javascript:alert(132)</script> +"`'><script>\xE3\x80\x80javascript:alert(133)</script> +"`'><script>\x09javascript:alert(134)</script> +"`'><script>\xE2\x80\x89javascript:alert(135)</script> +"`'><script>\xE2\x80\x85javascript:alert(136)</script> +"`'><script>\xE2\x80\x88javascript:alert(137)</script> +"`'><script>\x00javascript:alert(138)</script> +"`'><script>\xE2\x80\xA8javascript:alert(139)</script> +"`'><script>\xE2\x80\x8Ajavascript:alert(140)</script> +"`'><script>\xE1\x9A\x80javascript:alert(141)</script> +"`'><script>\x0Cjavascript:alert(142)</script> +"`'><script>\x2Bjavascript:alert(143)</script> +"`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)</script> +"`'><script>-javascript:alert(145)</script> +"`'><script>\x0Ajavascript:alert(146)</script> +"`'><script>\xE2\x80\xAFjavascript:alert(147)</script> +"`'><script>\x7Ejavascript:alert(148)</script> +"`'><script>\xE2\x80\x87javascript:alert(149)</script> +"`'><script>\xE2\x81\x9Fjavascript:alert(150)</script> +"`'><script>\xE2\x80\xA9javascript:alert(151)</script> +"`'><script>\xC2\x85javascript:alert(152)</script> +"`'><script>\xEF\xBF\xAEjavascript:alert(153)</script> +"`'><script>\xE2\x80\x83javascript:alert(154)</script> +"`'><script>\xE2\x80\x8Bjavascript:alert(155)</script> +"`'><script>\xEF\xBF\xBEjavascript:alert(156)</script> +"`'><script>\xE2\x80\x80javascript:alert(157)</script> +"`'><script>\x21javascript:alert(158)</script> +"`'><script>\xE2\x80\x82javascript:alert(159)</script> +"`'><script>\xE2\x80\x86javascript:alert(160)</script> +"`'><script>\xE1\xA0\x8Ejavascript:alert(161)</script> +"`'><script>\x0Bjavascript:alert(162)</script> +"`'><script>\x20javascript:alert(163)</script> +"`'><script>\xC2\xA0javascript:alert(164)</script> +<img \x00src=x onerror="alert(165)"> +<img \x47src=x onerror="javascript:alert(166)"> +<img \x11src=x onerror="javascript:alert(167)"> +<img \x12src=x onerror="javascript:alert(168)"> +<img\x47src=x onerror="javascript:alert(169)"> +<img\x10src=x onerror="javascript:alert(170)"> +<img\x13src=x onerror="javascript:alert(171)"> +<img\x32src=x onerror="javascript:alert(172)"> +<img\x47src=x onerror="javascript:alert(173)"> +<img\x11src=x onerror="javascript:alert(174)"> +<img \x47src=x onerror="javascript:alert(175)"> +<img \x34src=x onerror="javascript:alert(176)"> +<img \x39src=x onerror="javascript:alert(177)"> +<img \x00src=x onerror="javascript:alert(178)"> +<img src\x09=x onerror="javascript:alert(179)"> +<img src\x10=x onerror="javascript:alert(180)"> +<img src\x13=x onerror="javascript:alert(181)"> +<img src\x32=x onerror="javascript:alert(182)"> +<img src\x12=x onerror="javascript:alert(183)"> +<img src\x11=x onerror="javascript:alert(184)"> +<img src\x00=x onerror="javascript:alert(185)"> +<img src\x47=x onerror="javascript:alert(186)"> +<img src=x\x09onerror="javascript:alert(187)"> +<img src=x\x10onerror="javascript:alert(188)"> +<img src=x\x11onerror="javascript:alert(189)"> +<img src=x\x12onerror="javascript:alert(190)"> +<img src=x\x13onerror="javascript:alert(191)"> +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)"> +<img src=x onerror=\x09"javascript:alert(193)"> +<img src=x onerror=\x10"javascript:alert(194)"> +<img src=x onerror=\x11"javascript:alert(195)"> +<img src=x onerror=\x12"javascript:alert(196)"> +<img src=x onerror=\x32"javascript:alert(197)"> +<img src=x onerror=\x00"javascript:alert(198)"> +<a href=java script:javascript:alert(199)>XXX</a> +<img src="x` `<script>javascript:alert(200)</script>"` `> +<img src onerror /" '"= alt=javascript:alert(201)//"> +<title onpropertychange=javascript:alert(202)> +<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>"> +<!--[if]><script>javascript:alert(204)</script --> +<!--[if<img src=x onerror=javascript:alert(205)//]> --> +<script src="/\%(jscript)s"></script> +<script src="\\%(jscript)s"></script> +<IMG """><SCRIPT>alert("206")</SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav   ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="   javascript:alert('219');"> +<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("220")> +<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<<SCRIPT>alert("221");//<</SCRIPT> +<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > +<SCRIPT SRC=//ha.ckers.org/.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http://ha.ckers.org/scriptlet.html < +\";alert('223');// +<u oncopy=alert()> Copy me</u> +<i onwheel=alert(224)> Scroll over me </i> +<plaintext> +http://a/%%30%30 +</textarea><script>alert(225)</script> +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?'; -- +_ +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) +_ +- +-- +--version +--help +$USER +/dev/null; touch /tmp/blns.fail ; echo +`touch /tmp/blns.fail` +$(touch /tmp/blns.fail) +@{[system "touch /tmp/blns.fail"]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby/Rails applications +_ +eval("puts 'hello world'") +System("ls -al /") +`ls -al /` +Kernel.exec("ls -al /") +Kernel.exit(1) +%x('ls -al /') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File:/// +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +/../../../../../../../../.././etc/passwd%00 +/../../../../../../../../.././etc/hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch /tmp/blns.shellshock1.fail; +() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 +_ +# MSDOS/Windows Special Filenames +# +# Strings which are reserved characters in MSDOS/Windows +_ +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http://www.cum.qc.ca/ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I.Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat/type on this file +_ +Roses are red, violets are blue.Hope you enjoy terminal hue +But now...for my greatest trick. +The quick brown fox.[Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of /etc/passwd +_ +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }} diff --git a/tests/blns.just-url_safe.capacity b/tests/blns.just-url_safe.capacity new file mode 100644 index 0000000..0614b7b --- /dev/null +++ b/tests/blns.just-url_safe.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +1 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +1 +17 +1 +45 +1 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +1 +20 +1 +76 +78 +1 +10 +10 +12 +1 +75 +18 +74 +72 +18 +67 +27 +1 +78 +59 +78 +62 +1 +75 +75 +76 +41 +59 +42 +67 +73 +62 +1 +67 +41 +67 +255 +1 +62 +72 +3 +3 +1 +17 +1 +66 +1 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +1 +39 +1 +83 +1 +9 +9 +18 +255 +1 +17 +1 +76 +1 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +1 +21 +1 +98 +1 +33 +33 +12 +9 +31 +56 +30 +15 +28 +1 +130 +1 +227 +1 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +1 +43 +1 +33 +1 +68 +60 +1 +2 +2 +1 +20 +1 +81 +1 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +1 +7 +1 +97 +1 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +1 +34 +1 +70 +53 +1 +41 +36 +24 +1 +17 +1 +101 +1 +9 +6 +1 +23 +1 +90 +1 +256 +111 +47 +3 +3 +224 +35 +1 +12 +1 +95 +1 +45 +57 +1 +15 +1 +136 +1 +13 +10 +10 +14 +10 +1 +12 +1 +126 +1 +264 +260 +258 +258 +51 +1 +20 +1 +95 +1 +192 +8 +1 +14 +1 +70 +1 +113 +148 +148 +148 +148 +148 +148 +113 +1 +18 +1 +87 +1 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +1 +15 +1 +69 +1 +18 +24 +13 +11 +44 +1 +1 +1 +1 +23 +1 +125 +1 +1 +2 +9 +6 +5 +38 +22 +23 +34 +1 +26 +1 +71 +1 +26 +18 +10 +23 +14 +14 +1 +26 +1 +83 +1 +138 +1 +24 +1 +256 +1 +5 +12 +2 +10 +3 +5 +2 +2 +8 +1 +16 +1 +89 +1 +46 +42 +1 +32 +1 +45 +1 +44 +58 +20 +7 +1 +33 +1 +56 +1 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +1 +24 +1 +79 +1 +29 +1 +20 +1 +112 +1 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +1 +17 +1 +56 +1 +211 +1 +23 +1 +62 +1 +78 +43 +48 +1 +21 +1 +59 +1 +61 +12 +15 +1 +28 +1 +87 +1 +8 +1 +18 +1 +56 +51 +1 +30 +72 diff --git a/tests/blns.just-url_safe.sanitised b/tests/blns.just-url_safe.sanitised new file mode 100644 index 0000000..0831706 --- /dev/null +++ b/tests/blns.just-url_safe.sanitised @@ -0,0 +1,742 @@ +__Reserved_Strings +_ +__Strings_which_may_be_used_elsewhere_in_code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +_ +__ +_ +__Numeric_Strings +_ +__Strings_which_can_be_interpreted_as_numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1_2 +-1E2 +-1E02 +-1E+02 +1_0 +0_0 +-2147483648_-1 +-9223372036854775808_-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0..0 +_ +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1_INF +-1_IND +1_QNAN +1_SNAN +1_IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1_000.00 +1'000.00 +1,000,000.00 +1_000_000.00 +1'000'000.00 +1.000,00 +1_000,00 +1'000,00 +1.000.000,00 +1_000_000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +__Special_Characters +_ +__ASCII_punctuation.__All_of_these_characters_may_need_to_be_escaped_in_some +__contexts.__Divided_into_three_groups_based_on_(US-layout)_keyboard_position. +_ +,._;'___-= +___:_____+ +!@_$___*()_~ +_ +__Non-whitespace_C0_controls:_U+0001_through_U+0008,_U+000E_through_U+001F, +__and_U+007F_(DEL) +__Often_forbidden_to_appear_in_various_text-based_file_formats_(e.g._XML), +__or_reused_for_internal_delimiters_on_the_theory_that_they_should_never +__appear_in_input. +__The_next_line_may_appear_to_be_blank_or_mojibake_in_some_viewers. +___________________________ +_ +__Non-whitespace_C1_controls:_U+0080_through_U+0084_and_U+0086_through_U+009F. +__Commonly_misinterpreted_as_additional_graphic_characters. +__The_next_line_may_appear_to_be_blank,_mojibake,_or_dingbats_in_some_viewers. +_______________________________ +_ +__Whitespace:_all_of_the_characters_with_category_Zs,_Zl,_or_Zp_(in_Unicode +__version_8.0.0),_plus_U+0009_(HT),_U+000B_(VT),_U+000C_(FF),_U+0085_(NEL), +__and_U+200B_(ZERO_WIDTH_SPACE),_which_are_in_the_C_categories_but_are_often +__treated_as_whitespace_in_some_contexts. +__This_file_unfortunately_cannot_express_strings_containing +__U+0000,_U+000A,_or_U+000D_(NUL,_LF,_CR). +__The_next_line_may_appear_to_be_blank_or_mojibake_in_some_viewers. +__The_next_line_may_be_flagged_for__trailing_whitespace__in_some_viewers. +_____             ​

  　 +_ +__Unicode_additional_control_characters:_all_of_the_characters_with +__general_category_Cf_(in_Unicode_8.0.0). +__The_next_line_may_appear_to_be_blank_or_mojibake_in_some_viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +_ +___Byte_order_marks_,_U+FEFF_and_U+FFFE,_each_on_its_own_line. +__The_next_two_lines_may_appear_to_be_blank_or_mojibake_in_some_viewers. + +_ +_ +__Unicode_Symbols +_ +__Strings_which_contain_common_unicode_symbols_(e.g._smart_quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +_⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +__Unicode_Subscript_Superscript_Accents +_ +__Strings_which_contain_unicode_subscripts_superscripts;_can_cause_rendering_issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +__Quotation_Marks +_ +__Strings_which_contain_misplaced_quotation_marks;_can_cause_encoding_errors +_ +' +_ +'' +__ +'_' +_''''_'_ +_'_'_''''_ +_foo_val=“bar”___ +_foo_val=“bar”___ +_foo_val=”bar“___ +_foo_val=_bar'___ +_ +__Two-Byte_Characters +_ +__Strings_which_contain_two-byte_characters:_can_cause_rendering_issues_or_character-length_issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원_어학연구소 +찦차를_타고_온_펲시맨과_쑛다리_똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +__Strings_which_contain_two-byte_letters:_can_cause_issues_with_naïve_UTF-16_capitalizers_which_think_that_16_bits_==_1_character +_ +𐐜_𐐔𐐇𐐝𐐀𐐡𐐇𐐓_𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔_𐐒𐐋𐐗_𐐒𐐌_𐐜_𐐡𐐀𐐖𐐇𐐤𐐓𐐝_𐐱𐑂_𐑄_𐐔𐐇𐐝𐐀𐐡𐐇𐐓_𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +__Special_Unicode_Characters_Union +_ +__A_super_string_recommended_by_VMware_Inc._Globalization_Team:_can_effectively_cause_rendering_issues_or_character-length_issues_to_validate_product_globalization_readiness. +_ +__表__________CJK_UNIFIED_IDEOGRAPHS_(U+8868) +__ポ__________KATAKANA_LETTER_PO_(U+30DD) +__あ__________HIRAGANA_LETTER_A_(U+3042) +__A___________LATIN_CAPITAL_LETTER_A_(U+0041) +__鷗__________CJK_UNIFIED_IDEOGRAPHS_(U+9DD7) +__Œ___________LATIN_SMALL_LIGATURE_OE_(U+0153)_ +__é___________LATIN_SMALL_LETTER_E_WITH_ACUTE_(U+00E9) +__Ｂ___________FULLWIDTH_LATIN_CAPITAL_LETTER_B_(U+FF22) +__逍__________CJK_UNIFIED_IDEOGRAPHS_(U+900D) +__Ü___________LATIN_SMALL_LETTER_U_WITH_DIAERESIS_(U+00FC) +__ß___________LATIN_SMALL_LETTER_SHARP_S_(U+00DF) +__ª___________FEMININE_ORDINAL_INDICATOR_(U+00AA) +__ą___________LATIN_SMALL_LETTER_A_WITH_OGONEK_(U+0105) +__ñ___________LATIN_SMALL_LETTER_N_WITH_TILDE_(U+00F1) +__丂__________CJK_UNIFIED_IDEOGRAPHS_(U+4E02) +__㐀__________CJK_Ideograph_Extension_A,_First_(U+3400) +__𠀀__________CJK_Ideograph_Extension_B,_First_(U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +__Changing_length_when_lowercased +_ +__Characters_which_increase_in_length_(2_to_3_bytes)_when_lowercased +__Credit:_https:__twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +__Japanese_Emoticons +_ +__Strings_which_consists_of_Japanese-style_emoticons_which_are_popular_on_the_web +_ +ヽ༼ຈل͜ຈ༽ﾉ_ヽ༼ຈل͜ຈ༽ﾉ +(｡◕_∀_◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・:*:・゜’(_☻_ω_☻_)。・:*:・゜’ +(╯°□°）╯︵_┻━┻) +(ﾉಥ益ಥ）ﾉ_┻━┻ +┬─┬ノ(_º___ºノ) +(_͡°_͜ʖ_͡°) +¯__(ツ)__¯ +_ +__Emoji +_ +__Strings_which_contain_Emoji;_should_be_the_same_behavior_as_two-byte_characters,_but_not_always +_ +😍 +👩🏽 +👨‍🦰_👨🏿‍🦰_👨‍🦱_👨🏿‍🦱_🦹🏿‍♂️ +👾_🙇_💁_🙅_🙆_🙋_🙎_🙍 +🐵_🙈_🙉_🙊 +❤️_💔_💌_💕_💞_💓_💗_💖_💘_💝_💟_💜_💛_💚_💙 +✋🏿_💪🏿_👐🏿_🙌🏿_👏🏿_🙏🏿 +👨‍👩‍👦_👨‍👩‍👧‍👦_👨‍👨‍👦_👩‍👩‍👧_👨‍👦_👨‍👧‍👦_👩‍👦_👩‍👧‍👦 +🚾_🆒_🆓_🆕_🆖_🆗_🆙_🏧 +0️⃣_1️⃣_2️⃣_3️⃣_4️⃣_5️⃣_6️⃣_7️⃣_8️⃣_9️⃣_🔟 +_ +________Regional_Indicator_Symbols +_ +________Regional_Indicator_Symbols_can_be_displayed_differently_across +________fonts,_and_have_a_number_of_special_behaviors +_ +🇺🇸🇷🇺🇸_🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +__Unicode_Numbers +_ +__Strings_which_contain_unicode_numbers;_if_the_code_is_localized,_it_should_see_the_input_as_numeric +_ +１２３ +١٢٣ +_ +__Right-To-Left_Strings +_ +__Strings_which_contain_text_that_should_be_rendered_RTL_if_possible_(e.g._Arabic,_Hebrew) +_ +ثم_نفس_سقطت_وبالتحديد،,_جزيرتي_باستخدام_أن_دنو._إذ_هنا؟_الستار_وتنصيب_كان._أهّل_ايطاليا،_بريطانيا-فرنسا_قد_أخذ._سليمان،_إتفاقية_بين_ما,_يذكر_. +בְּרֵאשִׁית,_בָּרָא_אֱלֹהִים,_אֵת_הַשָּׁמַיִם,_וְאֵת_הָאָרֶץ +הָיְתָהtestالصفحات_التّحول +﷽ +ﷺ +مُنَاقَشَةُ_سُبُلِ_اِسْتِخْدَامِ_اللُّغَةِ_فِي_النُّظُمِ_الْقَائِمَةِ_وَفِيم_يَخُصَّ_التَّطْبِيقَاتُ_الْحاسُوبِيَّةُ، +الكل_في_المجمو_عة_(5) +_ +__Ogham_Text +_ +__The_only_unicode_alphabet_to_use_a_space_which_isn't_empty_but_should_still_act_like_a_space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ +_ +__Trick_Unicode +_ +__Strings_which_contain_unicode_with_unusual_properties_(e.g._Right-to-left_override)_(c.f._http:__www.unicode.org_charts_PDF_U2000.pdf) +_ +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ +_ +__Zalgo_Text +_ +__Strings_which_contain__corrupted__text._The_corruption_will_not_appear_in_non-HTML_text,_however._(via_http:__www.eeemo.net) +_ +Ṱ̺̺̕o͞_̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤_̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎_̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳_̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎_̰t͔̦h̞̲e̢̤_͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍_̨o͚̪͡f̘̣̬_̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔_͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜_̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟_̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜_̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮_҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕_̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖_̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ_̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +__Unicode_Upsidedown +_ +__Strings_which_contain_unicode_with_an__upsidedown__effect_(via_http:__www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ_ɐuƃɐɯ_ǝɹolop_ʇǝ_ǝɹoqɐl_ʇn_ʇunpᴉpᴉɔuᴉ_ɹodɯǝʇ_poɯsnᴉǝ_op_pǝs_'ʇᴉlǝ_ƃuᴉɔsᴉdᴉpɐ_ɹnʇǝʇɔǝsuoɔ_'ʇǝɯɐ_ʇᴉs_ɹolop_ɯnsdᴉ_ɯǝɹo˥ +00˙Ɩ$- +_ +__Unicode_font +_ +__Strings_which_contain_bold_italic_etc._versions_of_normal_characters +_ +Ｔｈｅ_ｑｕｉｃｋ_ｂｒｏｗｎ_ｆｏｘ_ｊｕｍｐｓ_ｏｖｅｒ_ｔｈｅ_ｌａｚｙ_ｄｏｇ +𝐓𝐡𝐞_𝐪𝐮𝐢𝐜𝐤_𝐛𝐫𝐨𝐰𝐧_𝐟𝐨𝐱_𝐣𝐮𝐦𝐩𝐬_𝐨𝐯𝐞𝐫_𝐭𝐡𝐞_𝐥𝐚𝐳𝐲_𝐝𝐨𝐠 +𝕿𝖍𝖊_𝖖𝖚𝖎𝖈𝖐_𝖇𝖗𝖔𝖜𝖓_𝖋𝖔𝖝_𝖏𝖚𝖒𝖕𝖘_𝖔𝖛𝖊𝖗_𝖙𝖍𝖊_𝖑𝖆𝖟𝖞_𝖉𝖔𝖌 +𝑻𝒉𝒆_𝒒𝒖𝒊𝒄𝒌_𝒃𝒓𝒐𝒘𝒏_𝒇𝒐𝒙_𝒋𝒖𝒎𝒑𝒔_𝒐𝒗𝒆𝒓_𝒕𝒉𝒆_𝒍𝒂𝒛𝒚_𝒅𝒐𝒈 +𝓣𝓱𝓮_𝓺𝓾𝓲𝓬𝓴_𝓫𝓻𝓸𝔀𝓷_𝓯𝓸𝔁_𝓳𝓾𝓶𝓹𝓼_𝓸𝓿𝓮𝓻_𝓽𝓱𝓮_𝓵𝓪𝔃𝔂_𝓭𝓸𝓰 +𝕋𝕙𝕖_𝕢𝕦𝕚𝕔𝕜_𝕓𝕣𝕠𝕨𝕟_𝕗𝕠𝕩_𝕛𝕦𝕞𝕡𝕤_𝕠𝕧𝕖𝕣_𝕥𝕙𝕖_𝕝𝕒𝕫𝕪_𝕕𝕠𝕘 +𝚃𝚑𝚎_𝚚𝚞𝚒𝚌𝚔_𝚋𝚛𝚘𝚠𝚗_𝚏𝚘𝚡_𝚓𝚞𝚖𝚙𝚜_𝚘𝚟𝚎𝚛_𝚝𝚑𝚎_𝚕𝚊𝚣𝚢_𝚍𝚘𝚐 +⒯⒣⒠_⒬⒰⒤⒞⒦_⒝⒭⒪⒲⒩_⒡⒪⒳_⒥⒰⒨⒫⒮_⒪⒱⒠⒭_⒯⒣⒠_⒧⒜⒵⒴_⒟⒪⒢ +_ +__Script_Injection +_ +__Strings_which_attempt_to_invoke_a_benign_script_injection;_shows_vulnerability_to_XSS +_ +_script_alert(0)__script_ +_lt;script_gt;alert(__39;1__39;);_lt;_script_gt; +_img_src=x_onerror=alert(2)___ +_svg__script_123_1_alert(3)__script_ +___script_alert(4)__script_ +'__script_alert(5)__script_ +__script_alert(6)__script_ +__script__script_alert(7)__script_ +____script____script__alert(8)____script__ + onfocus=JaVaSCript:alert(9)_autofocus +__onfocus=JaVaSCript:alert(10)_autofocus +'_onfocus=JaVaSCript:alert(11)_autofocus +＜script＞alert(12)＜_script＞ +_sc_script_ript_alert(13)__sc__script_ript_ +--__script_alert(14)__script_ +_;alert(15);t=_ +';alert(16);t=' +JavaSCript:alert(17) +;alert(18); +src=JaVaSCript:prompt(19) +___script_alert(20);__script_x=_ +'__script_alert(21);__script_x=' +__script_alert(22);__script_x= +__autofocus_onkeyup=_javascript:alert(23) +'_autofocus_onkeyup='javascript:alert(24) +_script_x20type=_text_javascript__javascript:alert(25);__script_ +_script_x3Etype=_text_javascript__javascript:alert(26);__script_ +_script_x0Dtype=_text_javascript__javascript:alert(27);__script_ +_script_x09type=_text_javascript__javascript:alert(28);__script_ +_script_x0Ctype=_text_javascript__javascript:alert(29);__script_ +_script_x2Ftype=_text_javascript__javascript:alert(30);__script_ +_script_x0Atype=_text_javascript__javascript:alert(31);__script_ +'_____x3Cscript_javascript:alert(32)__script_ +'_____x00script_javascript:alert(33)__script_ +ABC_div_style=_x_x3Aexpression(javascript:alert(34)__DEF +ABC_div_style=_x:expression_x5C(javascript:alert(35)__DEF +ABC_div_style=_x:expression_x00(javascript:alert(36)__DEF +ABC_div_style=_x:exp_x00ression(javascript:alert(37)__DEF +ABC_div_style=_x:exp_x5Cression(javascript:alert(38)__DEF +ABC_div_style=_x:_x0Aexpression(javascript:alert(39)__DEF +ABC_div_style=_x:_x09expression(javascript:alert(40)__DEF +ABC_div_style=_x:_xE3_x80_x80expression(javascript:alert(41)__DEF +ABC_div_style=_x:_xE2_x80_x84expression(javascript:alert(42)__DEF +ABC_div_style=_x:_xC2_xA0expression(javascript:alert(43)__DEF +ABC_div_style=_x:_xE2_x80_x80expression(javascript:alert(44)__DEF +ABC_div_style=_x:_xE2_x80_x8Aexpression(javascript:alert(45)__DEF +ABC_div_style=_x:_x0Dexpression(javascript:alert(46)__DEF +ABC_div_style=_x:_x0Cexpression(javascript:alert(47)__DEF +ABC_div_style=_x:_xE2_x80_x87expression(javascript:alert(48)__DEF +ABC_div_style=_x:_xEF_xBB_xBFexpression(javascript:alert(49)__DEF +ABC_div_style=_x:_x20expression(javascript:alert(50)__DEF +ABC_div_style=_x:_xE2_x80_x88expression(javascript:alert(51)__DEF +ABC_div_style=_x:_x00expression(javascript:alert(52)__DEF +ABC_div_style=_x:_xE2_x80_x8Bexpression(javascript:alert(53)__DEF +ABC_div_style=_x:_xE2_x80_x86expression(javascript:alert(54)__DEF +ABC_div_style=_x:_xE2_x80_x85expression(javascript:alert(55)__DEF +ABC_div_style=_x:_xE2_x80_x82expression(javascript:alert(56)__DEF +ABC_div_style=_x:_x0Bexpression(javascript:alert(57)__DEF +ABC_div_style=_x:_xE2_x80_x81expression(javascript:alert(58)__DEF +ABC_div_style=_x:_xE2_x80_x83expression(javascript:alert(59)__DEF +ABC_div_style=_x:_xE2_x80_x89expression(javascript:alert(60)__DEF +_a_href=__x0Bjavascript:javascript:alert(61)__id=_fuzzelement1__test__a_ +_a_href=__x0Fjavascript:javascript:alert(62)__id=_fuzzelement1__test__a_ +_a_href=__xC2_xA0javascript:javascript:alert(63)__id=_fuzzelement1__test__a_ +_a_href=__x05javascript:javascript:alert(64)__id=_fuzzelement1__test__a_ +_a_href=__xE1_xA0_x8Ejavascript:javascript:alert(65)__id=_fuzzelement1__test__a_ +_a_href=__x18javascript:javascript:alert(66)__id=_fuzzelement1__test__a_ +_a_href=__x11javascript:javascript:alert(67)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x88javascript:javascript:alert(68)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x89javascript:javascript:alert(69)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x80javascript:javascript:alert(70)__id=_fuzzelement1__test__a_ +_a_href=__x17javascript:javascript:alert(71)__id=_fuzzelement1__test__a_ +_a_href=__x03javascript:javascript:alert(72)__id=_fuzzelement1__test__a_ +_a_href=__x0Ejavascript:javascript:alert(73)__id=_fuzzelement1__test__a_ +_a_href=__x1Ajavascript:javascript:alert(74)__id=_fuzzelement1__test__a_ +_a_href=__x00javascript:javascript:alert(75)__id=_fuzzelement1__test__a_ +_a_href=__x10javascript:javascript:alert(76)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x82javascript:javascript:alert(77)__id=_fuzzelement1__test__a_ +_a_href=__x20javascript:javascript:alert(78)__id=_fuzzelement1__test__a_ +_a_href=__x13javascript:javascript:alert(79)__id=_fuzzelement1__test__a_ +_a_href=__x09javascript:javascript:alert(80)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x8Ajavascript:javascript:alert(81)__id=_fuzzelement1__test__a_ +_a_href=__x14javascript:javascript:alert(82)__id=_fuzzelement1__test__a_ +_a_href=__x19javascript:javascript:alert(83)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_xAFjavascript:javascript:alert(84)__id=_fuzzelement1__test__a_ +_a_href=__x1Fjavascript:javascript:alert(85)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x81javascript:javascript:alert(86)__id=_fuzzelement1__test__a_ +_a_href=__x1Djavascript:javascript:alert(87)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x87javascript:javascript:alert(88)__id=_fuzzelement1__test__a_ +_a_href=__x07javascript:javascript:alert(89)__id=_fuzzelement1__test__a_ +_a_href=__xE1_x9A_x80javascript:javascript:alert(90)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x83javascript:javascript:alert(91)__id=_fuzzelement1__test__a_ +_a_href=__x04javascript:javascript:alert(92)__id=_fuzzelement1__test__a_ +_a_href=__x01javascript:javascript:alert(93)__id=_fuzzelement1__test__a_ +_a_href=__x08javascript:javascript:alert(94)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x84javascript:javascript:alert(95)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x86javascript:javascript:alert(96)__id=_fuzzelement1__test__a_ +_a_href=__xE3_x80_x80javascript:javascript:alert(97)__id=_fuzzelement1__test__a_ +_a_href=__x12javascript:javascript:alert(98)__id=_fuzzelement1__test__a_ +_a_href=__x0Djavascript:javascript:alert(99)__id=_fuzzelement1__test__a_ +_a_href=__x0Ajavascript:javascript:alert(100)__id=_fuzzelement1__test__a_ +_a_href=__x0Cjavascript:javascript:alert(101)__id=_fuzzelement1__test__a_ +_a_href=__x15javascript:javascript:alert(102)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_xA8javascript:javascript:alert(103)__id=_fuzzelement1__test__a_ +_a_href=__x16javascript:javascript:alert(104)__id=_fuzzelement1__test__a_ +_a_href=__x02javascript:javascript:alert(105)__id=_fuzzelement1__test__a_ +_a_href=__x1Bjavascript:javascript:alert(106)__id=_fuzzelement1__test__a_ +_a_href=__x06javascript:javascript:alert(107)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_xA9javascript:javascript:alert(108)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x80_x85javascript:javascript:alert(109)__id=_fuzzelement1__test__a_ +_a_href=__x1Ejavascript:javascript:alert(110)__id=_fuzzelement1__test__a_ +_a_href=__xE2_x81_x9Fjavascript:javascript:alert(111)__id=_fuzzelement1__test__a_ +_a_href=__x1Cjavascript:javascript:alert(112)__id=_fuzzelement1__test__a_ +_a_href=_javascript_x00:javascript:alert(113)__id=_fuzzelement1__test__a_ +_a_href=_javascript_x3A:javascript:alert(114)__id=_fuzzelement1__test__a_ +_a_href=_javascript_x09:javascript:alert(115)__id=_fuzzelement1__test__a_ +_a_href=_javascript_x0D:javascript:alert(116)__id=_fuzzelement1__test__a_ +_a_href=_javascript_x0A:javascript:alert(117)__id=_fuzzelement1__test__a_ +__'__img_src=xxx:x__x0Aonerror=javascript:alert(118)_ +__'__img_src=xxx:x__x22onerror=javascript:alert(119)_ +__'__img_src=xxx:x__x0Bonerror=javascript:alert(120)_ +__'__img_src=xxx:x__x0Donerror=javascript:alert(121)_ +__'__img_src=xxx:x__x2Fonerror=javascript:alert(122)_ +__'__img_src=xxx:x__x09onerror=javascript:alert(123)_ +__'__img_src=xxx:x__x0Conerror=javascript:alert(124)_ +__'__img_src=xxx:x__x00onerror=javascript:alert(125)_ +__'__img_src=xxx:x__x27onerror=javascript:alert(126)_ +__'__img_src=xxx:x__x20onerror=javascript:alert(127)_ +__'__script__x3Bjavascript:alert(128)__script_ +__'__script__x0Djavascript:alert(129)__script_ +__'__script__xEF_xBB_xBFjavascript:alert(130)__script_ +__'__script__xE2_x80_x81javascript:alert(131)__script_ +__'__script__xE2_x80_x84javascript:alert(132)__script_ +__'__script__xE3_x80_x80javascript:alert(133)__script_ +__'__script__x09javascript:alert(134)__script_ +__'__script__xE2_x80_x89javascript:alert(135)__script_ +__'__script__xE2_x80_x85javascript:alert(136)__script_ +__'__script__xE2_x80_x88javascript:alert(137)__script_ +__'__script__x00javascript:alert(138)__script_ +__'__script__xE2_x80_xA8javascript:alert(139)__script_ +__'__script__xE2_x80_x8Ajavascript:alert(140)__script_ +__'__script__xE1_x9A_x80javascript:alert(141)__script_ +__'__script__x0Cjavascript:alert(142)__script_ +__'__script__x2Bjavascript:alert(143)__script_ +__'__script__xF0_x90_x96_x9Ajavascript:alert(144)__script_ +__'__script_-javascript:alert(145)__script_ +__'__script__x0Ajavascript:alert(146)__script_ +__'__script__xE2_x80_xAFjavascript:alert(147)__script_ +__'__script__x7Ejavascript:alert(148)__script_ +__'__script__xE2_x80_x87javascript:alert(149)__script_ +__'__script__xE2_x81_x9Fjavascript:alert(150)__script_ +__'__script__xE2_x80_xA9javascript:alert(151)__script_ +__'__script__xC2_x85javascript:alert(152)__script_ +__'__script__xEF_xBF_xAEjavascript:alert(153)__script_ +__'__script__xE2_x80_x83javascript:alert(154)__script_ +__'__script__xE2_x80_x8Bjavascript:alert(155)__script_ +__'__script__xEF_xBF_xBEjavascript:alert(156)__script_ +__'__script__xE2_x80_x80javascript:alert(157)__script_ +__'__script__x21javascript:alert(158)__script_ +__'__script__xE2_x80_x82javascript:alert(159)__script_ +__'__script__xE2_x80_x86javascript:alert(160)__script_ +__'__script__xE1_xA0_x8Ejavascript:alert(161)__script_ +__'__script__x0Bjavascript:alert(162)__script_ +__'__script__x20javascript:alert(163)__script_ +__'__script__xC2_xA0javascript:alert(164)__script_ +_img__x00src=x_onerror=_alert(165)__ +_img__x47src=x_onerror=_javascript:alert(166)__ +_img__x11src=x_onerror=_javascript:alert(167)__ +_img__x12src=x_onerror=_javascript:alert(168)__ +_img_x47src=x_onerror=_javascript:alert(169)__ +_img_x10src=x_onerror=_javascript:alert(170)__ +_img_x13src=x_onerror=_javascript:alert(171)__ +_img_x32src=x_onerror=_javascript:alert(172)__ +_img_x47src=x_onerror=_javascript:alert(173)__ +_img_x11src=x_onerror=_javascript:alert(174)__ +_img__x47src=x_onerror=_javascript:alert(175)__ +_img__x34src=x_onerror=_javascript:alert(176)__ +_img__x39src=x_onerror=_javascript:alert(177)__ +_img__x00src=x_onerror=_javascript:alert(178)__ +_img_src_x09=x_onerror=_javascript:alert(179)__ +_img_src_x10=x_onerror=_javascript:alert(180)__ +_img_src_x13=x_onerror=_javascript:alert(181)__ +_img_src_x32=x_onerror=_javascript:alert(182)__ +_img_src_x12=x_onerror=_javascript:alert(183)__ +_img_src_x11=x_onerror=_javascript:alert(184)__ +_img_src_x00=x_onerror=_javascript:alert(185)__ +_img_src_x47=x_onerror=_javascript:alert(186)__ +_img_src=x_x09onerror=_javascript:alert(187)__ +_img_src=x_x10onerror=_javascript:alert(188)__ +_img_src=x_x11onerror=_javascript:alert(189)__ +_img_src=x_x12onerror=_javascript:alert(190)__ +_img_src=x_x13onerror=_javascript:alert(191)__ +_img_a__b__c_src_d_=x_e_onerror=_f__alert(192)__ +_img_src=x_onerror=_x09_javascript:alert(193)__ +_img_src=x_onerror=_x10_javascript:alert(194)__ +_img_src=x_onerror=_x11_javascript:alert(195)__ +_img_src=x_onerror=_x12_javascript:alert(196)__ +_img_src=x_onerror=_x32_javascript:alert(197)__ +_img_src=x_onerror=_x00_javascript:alert(198)__ +_a_href=java__1__2__3__4__5__6__7__8__11__12script:javascript:alert(199)_XXX__a_ +_img_src=_x____script_javascript:alert(200)__script______ +_img_src_onerror____'_=_alt=javascript:alert(201)____ +_title_onpropertychange=javascript:alert(202)___title__title_title=_ +_a_href=http:__foo.bar__x=_y___a__img_alt=____img_src=x:x_onerror=javascript:alert(203)___a___ +_!--_if___script_javascript:alert(204)__script_--_ +_!--_if_img_src=x_onerror=javascript:alert(205)_____--_ +_script_src=____(jscript)s____script_ +_script_src=____(jscript)s____script_ +_IMG______SCRIPT_alert(_206_)__SCRIPT___ +_IMG_SRC=javascript:alert(String.fromCharCode(50,48,55))_ +_IMG_SRC=__onmouseover=_alert('208')__ +_IMG_SRC=_onmouseover=_alert('209')__ +_IMG_onmouseover=_alert('210')__ +_IMG_SRC=__106;__97;__118;__97;__115;__99;__114;__105;__112;__116;__58;__97;__108;__101;__114;__116;__40;__39;__50;__49;__49;__39;__41;_ +_IMG_SRC=__0000106__0000097__0000118__0000097__0000115__0000099__0000114__0000105__0000112__0000116__0000058__0000097__0000108__0000101__0000114__0000116__0000040__0000039__0000050__0000049__0000050__0000039__0000041_ +_IMG_SRC=__x6A__x61__x76__x61__x73__x63__x72__x69__x70__x74__x3A__x61__x6C__x65__x72__x74__x28__x27__x32__x31__x33__x27__x29_ +_IMG_SRC=_jav_ _ascript:alert('214');__ +_IMG_SRC=_jav__x09;ascript:alert('215');__ +_IMG_SRC=_jav__x0A;ascript:alert('216');__ +_IMG_SRC=_jav__x0D;ascript:alert('217');__ +perl_-e_'print___IMG_SRC=java_0script:alert(__218__)__;'___out +_IMG_SRC=____14;_ javascript:alert('219');__ +_SCRIPT_XSS_SRC=_http:__ha.ckers.org_xss.js____SCRIPT_ +_BODY_onload!_$__()*~+-_.,:;_@_______=alert(_220_)_ +_SCRIPT_SRC=_http:__ha.ckers.org_xss.js____SCRIPT_ +__SCRIPT_alert(_221_);_____SCRIPT_ +_SCRIPT_SRC=http:__ha.ckers.org_xss.js___B__ +_SCRIPT_SRC=__ha.ckers.org_.j_ +_IMG_SRC=_javascript:alert('222')_ +_iframe_src=http:__ha.ckers.org_scriptlet.html__ +__;alert('223');__ +_u_oncopy=alert()__Copy_me__u_ +_i_onwheel=alert(224)__Scroll_over_me___i_ +_plaintext_ +http:__a___30_30 +__textarea__script_alert(225)__script_ +_ +__SQL_Injection +_ +__Strings_which_can_cause_a_SQL_injection_if_inputs_are_not_sanitized +_ +1;DROP_TABLE_users +1';_DROP_TABLE_users--_1 +'_OR_1=1_--_1 +'_OR_'1'='1 +';_EXEC_sp_MSForEachTable_'DROP_TABLE__';_-- +_ +_ +_ +_ +__Server_Code_Injection +_ +__Strings_which_can_cause_user_to_run_code_on_server_as_a_privileged_user_(c.f._https:__news.ycombinator.com_item_id=7665153) +_ +- +-- +--version +--help +$USER +_dev_null;_touch__tmp_blns.fail_;_echo +_touch__tmp_blns.fail_ +$(touch__tmp_blns.fail) +@__system__touch__tmp_blns.fail___ +_ +__Command_Injection_(Ruby) +_ +__Strings_which_can_call_system_commands_within_Ruby_Rails_applications +_ +eval(_puts_'hello_world'_) +System(_ls_-al___) +_ls_-al___ +Kernel.exec(_ls_-al___) +Kernel.exit(1) +_x('ls_-al__') +_ +_______XXE_Injection_(XML) +_ +__String_which_can_reveal_system_files_when_parsed_by_a_badly_configured_XML_parser +_ +__xml_version=_1.0__encoding=_ISO-8859-1____!DOCTYPE_foo____!ELEMENT_foo_ANY___!ENTITY_xxe_SYSTEM__file:___etc_passwd______foo__xxe;__foo_ +_ +__Unwanted_Interpolation +_ +__Strings_which_can_be_accidentally_expanded_into_different_strings_if_evaluated_in_the_wrong_context,_e.g._used_as_a_printf_format_string_or_via_Perl_or_shell_eval._Might_expose_sensitive_data_from_the_program_doing_the_interpolation,_or_might_just_repr. +_ +$HOME +$ENV_'HOME'_ +_d +_s_s_s_s_s +_0_ +_*.*s +_@ +_n +File:___ +_ +__File_Inclusion +_ +__Strings_which_can_cause_user_to_pull_in_files_that_should_not_be_a_part_of_a_web_server +_ +.._.._.._.._.._.._.._.._.._.._.._etc_passwd_00 +.._.._.._.._.._.._.._.._.._.._.._etc_hosts +_ +__Known_CVEs_and_Vulnerabilities +_ +__Strings_that_test_for_known_vulnerabilities +_ +()___0;__;_touch__tmp_blns.shellshock1.fail; +()____;______$($())____touch__tmp_blns.shellshock2.fail;__ +_____s(un='_s')_=__u ++++ATH0 +_ +__MSDOS_Windows_Special_Filenames +_ +__Strings_which_are_reserved_characters_in_MSDOS_Windows +_ +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 +_ +____IRC_specific_strings +_ +____Strings_that_may_occur_on_IRC_clients_that_make_security_products_freak_out +_ +DCC_SEND_STARTKEYLOGGER_0_0_0 +_ +__Scunthorpe_Problem +_ +__Innocuous_strings_which_may_be_blocked_by_profanity_filters_(https:__en.wikipedia.org_wiki_Scunthorpe_problem) +_ +Scunthorpe_General_Hospital +Penistone_Community_Church +Lightwater_Country_Park +Jimmy_Clitheroe +Horniman_Museum +shitake_mushrooms +RomansInSussex.co.uk +http:__www.cum.qc.ca_ +Craig_Cockburn,_Software_Specialist +Linda_Callahan +Dr._Herman_I._Libshitz +magna_cum_laude +Super_Bowl_XXX +medieval_erection_of_parapets +evaluate +mocha +expression +Arsenal_canal +classic +Tyson_Gay +Dick_Van_Dyke +basement +_ +__Human_injection +_ +__Strings_which_may_cause_human_to_reinterpret_worldview +_ +If_you're_reading_this,_you've_been_in_a_coma_for_almost_20_years_now._We're_trying_a_new_technique._We_don't_know_where_this_message_will_end_up_in_your_dream,_but_we_hope_it_works._Please_wake_up,_we_miss_you. +_ +__Terminal_escape_codes +_ +__Strings_which_punish_the_fools_who_use_cat_type_on_this_file +_ +Roses_are___0;31mred__0m,_violets_are___0;34mblue._Hope_you_enjoy_terminal_hue +But_now...__20Cfor_my_greatest_trick...__8m +The_quic______k_brown_fo___________x...__Beeeep_ +_ +__iOS_Vulnerabilities +_ +__Strings_which_crashed_iMessage_in_various_versions_of_iOS +_ +Powerلُلُصّبُلُلصّبُررً_ॣ_ॣh_ॣ_ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +__Persian_special_characters +_ +__This_is_a_four_characters_string_which_includes_Persian_special_characters_(گچپژ) +_ +گچپژ +_ +__jinja2_injection +_ +__first_one_is_supposed_to_raise__MemoryError__exception +__second,_obviously,_prints_contents_of__etc_passwd +_ +___print_'x'_*_64_*_1024**3___ +_____.__class__.__mro___2_.__subclasses__()_40_(__etc_passwd_).read()___ diff --git a/tests/blns.just-windows_safe.capacity b/tests/blns.just-windows_safe.capacity new file mode 100644 index 0000000..a64f1d6 --- /dev/null +++ b/tests/blns.just-windows_safe.capacity @@ -0,0 +1,742 @@ +19 +2 +46 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +15 +5 +12 +2 +3 +1 +18 +2 +46 +1 +2 +2 +5 +5 +4 +4 +5 +6 +3 +5 +7 +5 +5 +6 +7 +4 +4 +15 +24 +3 +5 +3 +5 +5 +5 +1 +6 +5 +5 +2 +6 +5 +7 +7 +8 +8 +4 +2 +2 +3 +97 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +19 +11 +40 +8 +8 +8 +12 +12 +12 +8 +9 +9 +12 +13 +13 +6 +3 +3 +23 +1 +21 +2 +76 +78 +1 +10 +11 +13 +1 +76 +19 +74 +73 +18 +67 +28 +1 +78 +59 +78 +63 +1 +76 +75 +77 +41 +60 +42 +67 +73 +63 +1 +68 +41 +67 +256 +1 +62 +72 +4 +4 +1 +18 +2 +66 +1 +26 +26 +29 +30 +22 +27 +30 +35 +13 +159 +21 +1 +40 +2 +84 +1 +10 +10 +19 +256 +1 +18 +2 +77 +1 +2 +2 +3 +3 +4 +9 +11 +22 +22 +22 +18 +1 +22 +2 +99 +1 +34 +34 +13 +10 +32 +57 +31 +16 +29 +1 +131 +1 +228 +1 +35 +2 +174 +2 +47 +43 +42 +46 +47 +49 +56 +58 +47 +60 +51 +51 +57 +56 +47 +57 +59 +1 +44 +1 +34 +2 +69 +60 +1 +3 +3 +1 +21 +2 +82 +1 +46 +20 +19 +12 +21 +45 +52 +32 +33 +26 +18 +14 +1 +8 +2 +98 +1 +5 +9 +74 +40 +20 +77 +53 +145 +40 +85 +1 +35 +2 +71 +54 +1 +42 +37 +25 +1 +18 +2 +102 +1 +10 +7 +1 +24 +2 +90 +1 +256 +112 +48 +4 +4 +225 +36 +1 +13 +2 +95 +1 +46 +58 +1 +16 +2 +136 +1 +14 +11 +11 +15 +11 +1 +13 +2 +126 +1 +264 +260 +258 +258 +52 +1 +21 +2 +95 +1 +193 +9 +1 +15 +2 +70 +1 +114 +149 +149 +149 +149 +149 +149 +114 +1 +19 +2 +88 +1 +26 +49 +31 +37 +28 +28 +27 +35 +43 +40 +41 +41 +35 +44 +30 +16 +16 +21 +12 +26 +33 +33 +31 +42 +42 +65 +65 +65 +65 +65 +65 +65 +46 +46 +57 +58 +58 +58 +58 +58 +58 +66 +66 +62 +66 +66 +58 +58 +66 +66 +58 +66 +58 +66 +66 +66 +66 +58 +66 +66 +66 +73 +73 +77 +73 +81 +73 +73 +81 +81 +81 +73 +73 +73 +73 +73 +73 +81 +73 +73 +73 +81 +73 +73 +81 +73 +81 +73 +81 +73 +81 +81 +73 +73 +73 +81 +81 +81 +73 +73 +74 +74 +74 +82 +74 +74 +74 +74 +82 +82 +74 +82 +74 +74 +74 +74 +74 +74 +54 +54 +54 +54 +54 +54 +54 +54 +54 +54 +47 +47 +55 +55 +55 +55 +47 +55 +55 +55 +47 +55 +55 +55 +47 +47 +59 +44 +47 +55 +47 +55 +55 +55 +51 +55 +55 +55 +55 +55 +47 +55 +55 +55 +47 +47 +51 +37 +48 +48 +48 +47 +47 +47 +47 +47 +47 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +47 +47 +47 +47 +47 +49 +48 +48 +48 +48 +48 +48 +81 +58 +54 +69 +94 +51 +56 +38 +38 +41 +57 +39 +38 +33 +137 +218 +126 +41 +43 +43 +43 +63 +46 +54 +51 +50 +35 +44 +30 +35 +48 +19 +31 +43 +12 +17 +39 +1 +16 +2 +70 +1 +19 +25 +14 +12 +45 +2 +2 +2 +1 +24 +2 +125 +1 +2 +3 +10 +7 +6 +38 +22 +23 +34 +1 +27 +2 +72 +1 +27 +19 +11 +23 +14 +15 +1 +27 +2 +84 +1 +138 +1 +25 +2 +256 +1 +6 +13 +3 +11 +4 +5 +3 +3 +9 +1 +17 +2 +90 +1 +46 +42 +1 +33 +2 +46 +1 +44 +58 +21 +8 +1 +34 +2 +57 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +25 +2 +80 +1 +30 +1 +21 +2 +112 +1 +28 +27 +24 +16 +16 +18 +20 +21 +36 +15 +22 +16 +15 +30 +9 +6 +11 +14 +8 +10 +14 +9 +1 +18 +2 +57 +1 +211 +1 +24 +2 +63 +1 +78 +43 +48 +1 +22 +2 +60 +1 +62 +13 +16 +1 +29 +2 +88 +1 +9 +1 +19 +2 +57 +52 +1 +31 +72 diff --git a/tests/blns.just-windows_safe.sanitised b/tests/blns.just-windows_safe.sanitised new file mode 100644 index 0000000..add68ac --- /dev/null +++ b/tests/blns.just-windows_safe.sanitised @@ -0,0 +1,742 @@ +#_Reserved Strings +# +#_Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +_ +__ +_ +#_Numeric Strings +# +#_Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1_2 +-1E2 +-1E02 +-1E+02 +1_0 +0_0 +-2147483648_-1 +-9223372036854775808_-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0..0 +. +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1#INF +-1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +#_Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +,._;'[]_-= +_____{}__+ +!@#$%^&_()`~ +_ +# Non-whitespace C0 controls_ U+0001 through U+0008, U+000E through U+001F, +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML), +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. +___________________________ +_ +# Non-whitespace C1 controls_ U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ +_ +# Whitespace_ all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL), +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for _trailing whitespace_ in some viewers. +___ …             ​

  　 +_ +# Unicode additional control characters_ all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +_ +# _Byte order marks_, U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +#_Unicode Symbols +# +#_Strings which contain common unicode symbols (e.g. smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +#_Unicode Subscript_Superscript_Accents +# +#_Strings which contain unicode subscripts_superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +#_Quotation Marks +# +#_Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +_ +'' +__ +'_' +_''''_'_ +_'_'_''''_ +_foo val=“bar” __ +_foo val=“bar” __ +_foo val=”bar“ __ +_foo val=`bar' __ +_ +#_Two-Byte Characters +# +#_Strings which contain two-byte characters_ can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +#_Strings which contain two-byte letters_ can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +#_Special Unicode Characters Union +# +#_A super string recommended by VMware Inc. Globalization Team_ can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +#_表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +#_ポ KATAKANA LETTER PO (U+30DD) +#_あ HIRAGANA LETTER A (U+3042) +#_A LATIN CAPITAL LETTER A (U+0041) +#_鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +#_Œ LATIN SMALL LIGATURE OE (U+0153) +#_é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +#_Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +#_逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +#_Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +#_ß LATIN SMALL LETTER SHARP S (U+00DF) +#_ª FEMININE ORDINAL INDICATOR (U+00AA) +#_ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +#_ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +#_丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +#_㐀 CJK Ideograph Extension A, First (U+3400) +#_𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +#_Changing length when lowercased +# +#_Characters which increase in length (2 to 3 bytes) when lowercased +#_Credit_ https___twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +#_Japanese Emoticons +# +#_Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,_) +・(￣∀￣)・___ +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・___・゜’( ☻ ω ☻ )。・___・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯__(ツ)__¯ +_ +#_Emoji +# +#_Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +#_Unicode Numbers +# +#_Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +#_Right-To-Left Strings +# +#_Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر . +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +#_Ogham Text +# +#_The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ +_ +#_Trick Unicode +# +#_Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http___www.unicode.org_charts_PDF_U2000.pdf) +_ +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ +_ +#_Zalgo Text +# +#_Strings which contain _corrupted_ text. The corruption will not appear in non-HTML text, however. (via http___www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +#_Unicode Upsidedown +# +#_Strings which contain unicode with an _upsidedown_ effect (via http___www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$- +_ +#_Unicode font +# +#_Strings which contain bold_italic_etc. versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +#_Script Injection +# +#_Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +_script_alert(0)__script_ +<script>alert('1');<_script> +_img src=x onerror=alert(2) __ +_svg__script_123_1_alert(3)__script_ +___script_alert(4)__script_ +'__script_alert(5)__script_ +__script_alert(6)__script_ +__script__script_alert(7)__script_ +_ _ script __ script _alert(8)_ _ script _ + onfocus=JaVaSCript_alert(9) autofocus +_ onfocus=JaVaSCript_alert(10) autofocus +' onfocus=JaVaSCript_alert(11) autofocus +＜script＞alert(12)＜_script＞ +_sc_script_ript_alert(13)__sc__script_ript_ +--__script_alert(14)__script_ +_;alert(15);t=_ +';alert(16);t=' +JavaSCript_alert(17) +;alert(18); +src=JaVaSCript_prompt(19) +___script_alert(20);__script x=_ +'__script_alert(21);__script x=' +__script_alert(22);__script x= +_ autofocus onkeyup=_javascript_alert(23) +' autofocus onkeyup='javascript_alert(24) +_script_x20type=_text_javascript__javascript_alert(25);__script_ +_script_x3Etype=_text_javascript__javascript_alert(26);__script_ +_script_x0Dtype=_text_javascript__javascript_alert(27);__script_ +_script_x09type=_text_javascript__javascript_alert(28);__script_ +_script_x0Ctype=_text_javascript__javascript_alert(29);__script_ +_script_x2Ftype=_text_javascript__javascript_alert(30);__script_ +_script_x0Atype=_text_javascript__javascript_alert(31);__script_ +'`____x3Cscript_javascript_alert(32)__script_ +'`____x00script_javascript_alert(33)__script_ +ABC_div style=_x_x3Aexpression(javascript_alert(34)__DEF +ABC_div style=_x_expression_x5C(javascript_alert(35)__DEF +ABC_div style=_x_expression_x00(javascript_alert(36)__DEF +ABC_div style=_x_exp_x00ression(javascript_alert(37)__DEF +ABC_div style=_x_exp_x5Cression(javascript_alert(38)__DEF +ABC_div style=_x__x0Aexpression(javascript_alert(39)__DEF +ABC_div style=_x__x09expression(javascript_alert(40)__DEF +ABC_div style=_x__xE3_x80_x80expression(javascript_alert(41)__DEF +ABC_div style=_x__xE2_x80_x84expression(javascript_alert(42)__DEF +ABC_div style=_x__xC2_xA0expression(javascript_alert(43)__DEF +ABC_div style=_x__xE2_x80_x80expression(javascript_alert(44)__DEF +ABC_div style=_x__xE2_x80_x8Aexpression(javascript_alert(45)__DEF +ABC_div style=_x__x0Dexpression(javascript_alert(46)__DEF +ABC_div style=_x__x0Cexpression(javascript_alert(47)__DEF +ABC_div style=_x__xE2_x80_x87expression(javascript_alert(48)__DEF +ABC_div style=_x__xEF_xBB_xBFexpression(javascript_alert(49)__DEF +ABC_div style=_x__x20expression(javascript_alert(50)__DEF +ABC_div style=_x__xE2_x80_x88expression(javascript_alert(51)__DEF +ABC_div style=_x__x00expression(javascript_alert(52)__DEF +ABC_div style=_x__xE2_x80_x8Bexpression(javascript_alert(53)__DEF +ABC_div style=_x__xE2_x80_x86expression(javascript_alert(54)__DEF +ABC_div style=_x__xE2_x80_x85expression(javascript_alert(55)__DEF +ABC_div style=_x__xE2_x80_x82expression(javascript_alert(56)__DEF +ABC_div style=_x__x0Bexpression(javascript_alert(57)__DEF +ABC_div style=_x__xE2_x80_x81expression(javascript_alert(58)__DEF +ABC_div style=_x__xE2_x80_x83expression(javascript_alert(59)__DEF +ABC_div style=_x__xE2_x80_x89expression(javascript_alert(60)__DEF +_a href=__x0Bjavascript_javascript_alert(61)_ id=_fuzzelement1__test__a_ +_a href=__x0Fjavascript_javascript_alert(62)_ id=_fuzzelement1__test__a_ +_a href=__xC2_xA0javascript_javascript_alert(63)_ id=_fuzzelement1__test__a_ +_a href=__x05javascript_javascript_alert(64)_ id=_fuzzelement1__test__a_ +_a href=__xE1_xA0_x8Ejavascript_javascript_alert(65)_ id=_fuzzelement1__test__a_ +_a href=__x18javascript_javascript_alert(66)_ id=_fuzzelement1__test__a_ +_a href=__x11javascript_javascript_alert(67)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x88javascript_javascript_alert(68)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x89javascript_javascript_alert(69)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x80javascript_javascript_alert(70)_ id=_fuzzelement1__test__a_ +_a href=__x17javascript_javascript_alert(71)_ id=_fuzzelement1__test__a_ +_a href=__x03javascript_javascript_alert(72)_ id=_fuzzelement1__test__a_ +_a href=__x0Ejavascript_javascript_alert(73)_ id=_fuzzelement1__test__a_ +_a href=__x1Ajavascript_javascript_alert(74)_ id=_fuzzelement1__test__a_ +_a href=__x00javascript_javascript_alert(75)_ id=_fuzzelement1__test__a_ +_a href=__x10javascript_javascript_alert(76)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x82javascript_javascript_alert(77)_ id=_fuzzelement1__test__a_ +_a href=__x20javascript_javascript_alert(78)_ id=_fuzzelement1__test__a_ +_a href=__x13javascript_javascript_alert(79)_ id=_fuzzelement1__test__a_ +_a href=__x09javascript_javascript_alert(80)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x8Ajavascript_javascript_alert(81)_ id=_fuzzelement1__test__a_ +_a href=__x14javascript_javascript_alert(82)_ id=_fuzzelement1__test__a_ +_a href=__x19javascript_javascript_alert(83)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_xAFjavascript_javascript_alert(84)_ id=_fuzzelement1__test__a_ +_a href=__x1Fjavascript_javascript_alert(85)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x81javascript_javascript_alert(86)_ id=_fuzzelement1__test__a_ +_a href=__x1Djavascript_javascript_alert(87)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x87javascript_javascript_alert(88)_ id=_fuzzelement1__test__a_ +_a href=__x07javascript_javascript_alert(89)_ id=_fuzzelement1__test__a_ +_a href=__xE1_x9A_x80javascript_javascript_alert(90)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x83javascript_javascript_alert(91)_ id=_fuzzelement1__test__a_ +_a href=__x04javascript_javascript_alert(92)_ id=_fuzzelement1__test__a_ +_a href=__x01javascript_javascript_alert(93)_ id=_fuzzelement1__test__a_ +_a href=__x08javascript_javascript_alert(94)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x84javascript_javascript_alert(95)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x86javascript_javascript_alert(96)_ id=_fuzzelement1__test__a_ +_a href=__xE3_x80_x80javascript_javascript_alert(97)_ id=_fuzzelement1__test__a_ +_a href=__x12javascript_javascript_alert(98)_ id=_fuzzelement1__test__a_ +_a href=__x0Djavascript_javascript_alert(99)_ id=_fuzzelement1__test__a_ +_a href=__x0Ajavascript_javascript_alert(100)_ id=_fuzzelement1__test__a_ +_a href=__x0Cjavascript_javascript_alert(101)_ id=_fuzzelement1__test__a_ +_a href=__x15javascript_javascript_alert(102)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_xA8javascript_javascript_alert(103)_ id=_fuzzelement1__test__a_ +_a href=__x16javascript_javascript_alert(104)_ id=_fuzzelement1__test__a_ +_a href=__x02javascript_javascript_alert(105)_ id=_fuzzelement1__test__a_ +_a href=__x1Bjavascript_javascript_alert(106)_ id=_fuzzelement1__test__a_ +_a href=__x06javascript_javascript_alert(107)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_xA9javascript_javascript_alert(108)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x80_x85javascript_javascript_alert(109)_ id=_fuzzelement1__test__a_ +_a href=__x1Ejavascript_javascript_alert(110)_ id=_fuzzelement1__test__a_ +_a href=__xE2_x81_x9Fjavascript_javascript_alert(111)_ id=_fuzzelement1__test__a_ +_a href=__x1Cjavascript_javascript_alert(112)_ id=_fuzzelement1__test__a_ +_a href=_javascript_x00_javascript_alert(113)_ id=_fuzzelement1__test__a_ +_a href=_javascript_x3A_javascript_alert(114)_ id=_fuzzelement1__test__a_ +_a href=_javascript_x09_javascript_alert(115)_ id=_fuzzelement1__test__a_ +_a href=_javascript_x0D_javascript_alert(116)_ id=_fuzzelement1__test__a_ +_a href=_javascript_x0A_javascript_alert(117)_ id=_fuzzelement1__test__a_ +`_'__img src=xxx_x _x0Aonerror=javascript_alert(118)_ +`_'__img src=xxx_x _x22onerror=javascript_alert(119)_ +`_'__img src=xxx_x _x0Bonerror=javascript_alert(120)_ +`_'__img src=xxx_x _x0Donerror=javascript_alert(121)_ +`_'__img src=xxx_x _x2Fonerror=javascript_alert(122)_ +`_'__img src=xxx_x _x09onerror=javascript_alert(123)_ +`_'__img src=xxx_x _x0Conerror=javascript_alert(124)_ +`_'__img src=xxx_x _x00onerror=javascript_alert(125)_ +`_'__img src=xxx_x _x27onerror=javascript_alert(126)_ +`_'__img src=xxx_x _x20onerror=javascript_alert(127)_ +_`'__script__x3Bjavascript_alert(128)__script_ +_`'__script__x0Djavascript_alert(129)__script_ +_`'__script__xEF_xBB_xBFjavascript_alert(130)__script_ +_`'__script__xE2_x80_x81javascript_alert(131)__script_ +_`'__script__xE2_x80_x84javascript_alert(132)__script_ +_`'__script__xE3_x80_x80javascript_alert(133)__script_ +_`'__script__x09javascript_alert(134)__script_ +_`'__script__xE2_x80_x89javascript_alert(135)__script_ +_`'__script__xE2_x80_x85javascript_alert(136)__script_ +_`'__script__xE2_x80_x88javascript_alert(137)__script_ +_`'__script__x00javascript_alert(138)__script_ +_`'__script__xE2_x80_xA8javascript_alert(139)__script_ +_`'__script__xE2_x80_x8Ajavascript_alert(140)__script_ +_`'__script__xE1_x9A_x80javascript_alert(141)__script_ +_`'__script__x0Cjavascript_alert(142)__script_ +_`'__script__x2Bjavascript_alert(143)__script_ +_`'__script__xF0_x90_x96_x9Ajavascript_alert(144)__script_ +_`'__script_-javascript_alert(145)__script_ +_`'__script__x0Ajavascript_alert(146)__script_ +_`'__script__xE2_x80_xAFjavascript_alert(147)__script_ +_`'__script__x7Ejavascript_alert(148)__script_ +_`'__script__xE2_x80_x87javascript_alert(149)__script_ +_`'__script__xE2_x81_x9Fjavascript_alert(150)__script_ +_`'__script__xE2_x80_xA9javascript_alert(151)__script_ +_`'__script__xC2_x85javascript_alert(152)__script_ +_`'__script__xEF_xBF_xAEjavascript_alert(153)__script_ +_`'__script__xE2_x80_x83javascript_alert(154)__script_ +_`'__script__xE2_x80_x8Bjavascript_alert(155)__script_ +_`'__script__xEF_xBF_xBEjavascript_alert(156)__script_ +_`'__script__xE2_x80_x80javascript_alert(157)__script_ +_`'__script__x21javascript_alert(158)__script_ +_`'__script__xE2_x80_x82javascript_alert(159)__script_ +_`'__script__xE2_x80_x86javascript_alert(160)__script_ +_`'__script__xE1_xA0_x8Ejavascript_alert(161)__script_ +_`'__script__x0Bjavascript_alert(162)__script_ +_`'__script__x20javascript_alert(163)__script_ +_`'__script__xC2_xA0javascript_alert(164)__script_ +_img _x00src=x onerror=_alert(165)__ +_img _x47src=x onerror=_javascript_alert(166)__ +_img _x11src=x onerror=_javascript_alert(167)__ +_img _x12src=x onerror=_javascript_alert(168)__ +_img_x47src=x onerror=_javascript_alert(169)__ +_img_x10src=x onerror=_javascript_alert(170)__ +_img_x13src=x onerror=_javascript_alert(171)__ +_img_x32src=x onerror=_javascript_alert(172)__ +_img_x47src=x onerror=_javascript_alert(173)__ +_img_x11src=x onerror=_javascript_alert(174)__ +_img _x47src=x onerror=_javascript_alert(175)__ +_img _x34src=x onerror=_javascript_alert(176)__ +_img _x39src=x onerror=_javascript_alert(177)__ +_img _x00src=x onerror=_javascript_alert(178)__ +_img src_x09=x onerror=_javascript_alert(179)__ +_img src_x10=x onerror=_javascript_alert(180)__ +_img src_x13=x onerror=_javascript_alert(181)__ +_img src_x32=x onerror=_javascript_alert(182)__ +_img src_x12=x onerror=_javascript_alert(183)__ +_img src_x11=x onerror=_javascript_alert(184)__ +_img src_x00=x onerror=_javascript_alert(185)__ +_img src_x47=x onerror=_javascript_alert(186)__ +_img src=x_x09onerror=_javascript_alert(187)__ +_img src=x_x10onerror=_javascript_alert(188)__ +_img src=x_x11onerror=_javascript_alert(189)__ +_img src=x_x12onerror=_javascript_alert(190)__ +_img src=x_x13onerror=_javascript_alert(191)__ +_img[a][b][c]src[d]=x[e]onerror=[f]_alert(192)__ +_img src=x onerror=_x09_javascript_alert(193)__ +_img src=x onerror=_x10_javascript_alert(194)__ +_img src=x onerror=_x11_javascript_alert(195)__ +_img src=x onerror=_x12_javascript_alert(196)__ +_img src=x onerror=_x32_javascript_alert(197)__ +_img src=x onerror=_x00_javascript_alert(198)__ +_a href=java script_javascript_alert(199)_XXX__a_ +_img src=_x` `_script_javascript_alert(200)__script__` `_ +_img src onerror __ '_= alt=javascript_alert(201)____ +_title onpropertychange=javascript_alert(202)___title__title title=_ +_a href=http___foo.bar_#x=`y___a__img alt=_`__img src=x_x onerror=javascript_alert(203)___a___ +_!--[if]__script_javascript_alert(204)__script --_ +_!--[if_img src=x onerror=javascript_alert(205)__]_ --_ +_script src=___%(jscript)s____script_ +_script src=___%(jscript)s____script_ +_IMG _____SCRIPT_alert(_206_)__SCRIPT___ +_IMG SRC=javascript_alert(String.fromCharCode(50,48,55))_ +_IMG SRC=# onmouseover=_alert('208')__ +_IMG SRC= onmouseover=_alert('209')__ +_IMG onmouseover=_alert('210')__ +_IMG SRC=javascript:alert('211')_ +_IMG SRC=javascript:alert('212')_ +_IMG SRC=javascript:alert('213')_ +_IMG SRC=_jav   ascript_alert('214');__ +_IMG SRC=_jav ascript_alert('215');__ +_IMG SRC=_jav ascript_alert('216');__ +_IMG SRC=_jav ascript_alert('217');__ +perl -e 'print __IMG SRC=java_0script_alert(__218__)__;' _ out +_IMG SRC=_   javascript_alert('219');__ +_SCRIPT_XSS SRC=_http___ha.ckers.org_xss.js____SCRIPT_ +_BODY onload!#$%&()_~+-_.,_;_@[___]^`=alert(_220_)_ +_SCRIPT_SRC=_http___ha.ckers.org_xss.js____SCRIPT_ +__SCRIPT_alert(_221_);_____SCRIPT_ +_SCRIPT SRC=http___ha.ckers.org_xss.js__ B _ +_SCRIPT SRC=__ha.ckers.org_.j_ +_IMG SRC=_javascript_alert('222')_ +_iframe src=http___ha.ckers.org_scriptlet.html _ +__;alert('223');__ +_u oncopy=alert()_ Copy me__u_ +_i onwheel=alert(224)_ Scroll over me __i_ +_plaintext_ +http___a_%%30%30 +__textarea__script_alert(225)__script_ +_ +#_SQL Injection +# +#_Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE _'; -- + +% +_ +_ +#_Server Code Injection +# +#_Strings which can cause user to run code on server as a privileged user (c.f. https___news.ycombinator.com_item_id=7665153) +_ +- +-- +--version +--help +$USER +_dev_null; touch _tmp_blns.fail ; echo +`touch _tmp_blns.fail` +$(touch _tmp_blns.fail) +@{[system _touch _tmp_blns.fail_]} +_ +#_Command Injection (Ruby) +# +#_Strings which can call system commands within Ruby_Rails applications +_ +eval(_puts 'hello world'_) +System(_ls -al __) +`ls -al _` +Kernel.exec(_ls -al __) +Kernel.exit(1) +%x('ls -al _') +_ +# XXE Injection (XML) +# +#_String which can reveal system files when parsed by a badly configured XML parser +_ +__xml version=_1.0_ encoding=_ISO-8859-1____!DOCTYPE foo [ _!ELEMENT foo ANY __!ENTITY xxe SYSTEM _file____etc_passwd_ _]__foo_&xxe;__foo_ +_ +#_Unwanted Interpolation +# +#_Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%_._s +%@ +%n +File____ +_ +#_File Inclusion +# +#_Strings which can cause user to pull in files that should not be a part of a web server +_ +.._.._.._.._.._.._.._.._.._.._.._etc_passwd%00 +.._.._.._.._.._.._.._.._.._.._.._etc_hosts +_ +#_Known CVEs and Vulnerabilities +# +#_Strings that test for known vulnerabilities +_ +() { 0; }; touch _tmp_blns.shellshock1.fail; +() { _; } __[$($())] { touch _tmp_blns.shellshock2.fail; } +___ %s(un='%s') = %u ++++ATH0 +_ +#_MSDOS_Windows Special Filenames +# +#_Strings which are reserved characters in MSDOS_Windows +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A_ +ZZ_ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +#_Scunthorpe Problem +# +#_Innocuous strings which may be blocked by profanity filters (https___en.wikipedia.org_wiki_Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http___www.cum.qc.ca_ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +#_Human injection +# +#_Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +#_Terminal escape codes +# +#_Strings which punish the fools who use cat_type on this file +_ +Roses are _[0;31mred_[0m, violets are _[0;34mblue. Hope you enjoy terminal hue +But now..._[20Cfor my greatest trick..._[8m +The quic______k brown fo___________x... [Beeeep] +_ +#_iOS Vulnerabilities +# +#_Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise _MemoryError_ exception +# second, obviously, prints contents of _etc_passwd +_ +{% print 'x' _ 64 _ 1024__3 %} +{{ __.__class__.__mro__[2].__subclasses__()[40](__etc_passwd_).read() }} diff --git a/tests/blns.no-extension_cleverness.capacity b/tests/blns.no-extension_cleverness.capacity new file mode 100644 index 0000000..7dc7c8d --- /dev/null +++ b/tests/blns.no-extension_cleverness.capacity @@ -0,0 +1,742 @@ +19 +2 +46 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +15 +5 +12 +2 +3 +1 +18 +2 +46 +1 +2 +2 +5 +6 +4 +4 +5 +6 +3 +6 +7 +5 +5 +6 +7 +4 +4 +15 +24 +3 +5 +3 +5 +5 +5 +2 +6 +5 +5 +2 +6 +6 +8 +8 +8 +8 +4 +2 +3 +3 +97 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +19 +11 +40 +9 +9 +9 +13 +13 +13 +9 +9 +9 +13 +13 +13 +6 +3 +3 +24 +1 +21 +2 +77 +79 +1 +11 +11 +13 +1 +76 +19 +75 +73 +19 +68 +28 +1 +79 +60 +79 +63 +1 +76 +76 +77 +42 +60 +43 +68 +74 +63 +1 +68 +42 +68 +256 +1 +63 +73 +4 +4 +1 +18 +2 +67 +1 +26 +26 +29 +30 +22 +27 +30 +35 +13 +159 +21 +1 +40 +2 +84 +1 +10 +10 +19 +256 +1 +18 +2 +77 +1 +2 +2 +3 +3 +4 +9 +11 +22 +22 +22 +18 +1 +22 +2 +99 +1 +34 +34 +13 +10 +32 +57 +31 +16 +29 +1 +131 +1 +228 +1 +35 +2 +175 +2 +47 +43 +42 +46 +47 +49 +56 +58 +47 +60 +51 +51 +57 +56 +47 +57 +59 +1 +44 +1 +34 +2 +69 +61 +1 +3 +3 +1 +21 +2 +82 +1 +46 +20 +19 +12 +21 +45 +52 +32 +33 +26 +18 +14 +1 +8 +2 +98 +1 +5 +9 +74 +40 +20 +77 +53 +145 +40 +85 +1 +35 +2 +71 +54 +1 +42 +37 +25 +1 +18 +2 +102 +1 +10 +7 +1 +24 +2 +91 +1 +256 +112 +48 +4 +4 +225 +36 +1 +13 +2 +96 +1 +46 +58 +1 +16 +2 +137 +1 +14 +11 +11 +15 +11 +1 +13 +2 +127 +1 +256 +256 +256 +256 +52 +1 +21 +2 +96 +1 +193 +9 +1 +15 +2 +71 +1 +114 +149 +149 +149 +149 +149 +149 +114 +1 +19 +2 +88 +1 +26 +49 +31 +37 +28 +28 +27 +35 +43 +40 +41 +41 +35 +44 +30 +16 +16 +21 +12 +26 +33 +33 +31 +42 +42 +65 +65 +65 +65 +65 +65 +65 +46 +46 +57 +58 +58 +58 +58 +58 +58 +66 +66 +62 +66 +66 +58 +58 +66 +66 +58 +66 +58 +66 +66 +66 +66 +58 +66 +66 +66 +73 +73 +77 +73 +81 +73 +73 +81 +81 +81 +73 +73 +73 +73 +73 +73 +81 +73 +73 +73 +81 +73 +73 +81 +73 +81 +73 +81 +73 +81 +81 +73 +73 +73 +81 +81 +81 +73 +73 +74 +74 +74 +82 +74 +74 +74 +74 +82 +82 +74 +82 +74 +74 +74 +74 +74 +74 +54 +54 +54 +54 +54 +54 +54 +54 +54 +54 +47 +47 +55 +55 +55 +55 +47 +55 +55 +55 +47 +55 +55 +55 +47 +47 +59 +44 +47 +55 +47 +55 +55 +55 +51 +55 +55 +55 +55 +55 +47 +55 +55 +55 +47 +47 +51 +37 +48 +48 +48 +47 +47 +47 +47 +47 +47 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +47 +47 +47 +47 +47 +49 +48 +48 +48 +48 +48 +48 +81 +58 +54 +69 +95 +51 +56 +38 +38 +41 +58 +39 +38 +33 +137 +218 +126 +41 +43 +43 +43 +63 +46 +55 +52 +51 +35 +45 +31 +35 +49 +19 +31 +43 +12 +17 +39 +1 +16 +2 +70 +1 +19 +25 +14 +12 +45 +2 +2 +2 +1 +24 +2 +126 +1 +2 +3 +10 +7 +6 +39 +23 +24 +35 +1 +27 +2 +72 +1 +27 +19 +11 +24 +15 +15 +1 +27 +2 +84 +1 +139 +1 +25 +2 +256 +1 +6 +13 +3 +11 +4 +6 +3 +3 +9 +1 +17 +2 +90 +1 +47 +43 +1 +33 +2 +46 +1 +45 +59 +21 +8 +1 +34 +2 +57 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +25 +2 +80 +1 +30 +1 +21 +2 +113 +1 +28 +27 +24 +16 +16 +18 +21 +22 +36 +15 +23 +16 +15 +30 +9 +6 +11 +14 +8 +10 +14 +9 +1 +18 +2 +57 +1 +212 +1 +24 +2 +63 +1 +79 +44 +49 +1 +22 +2 +60 +1 +62 +13 +16 +1 +29 +2 +88 +1 +9 +1 +19 +2 +57 +52 +1 +31 +73 diff --git a/tests/blns.no-extension_cleverness.sanitised b/tests/blns.no-extension_cleverness.sanitised new file mode 100644 index 0000000..dcdc91a --- /dev/null +++ b/tests/blns.no-extension_cleverness.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +_ +_ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1_0 +0_0 +2147483648_-1 +9223372036854775808_-1 +0 +0.0 ++0 ++0.0 +0.00 +0..0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +1 +_ +_ +_ +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position +_ +'[]_-= +{}__+ +!@#$%^&_()`~ +_ +# Non-whitespace C0 controls_ U+0001 through U+0008, U+000E through U+001F +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML) +# or reused for internal delimiters on the theory that they should never +# appear in input +# The next line may appear to be blank or mojibake in some viewers +_ +_ +# Non-whitespace C1 controls_ U+0080 through U+0084 and U+0086 through U+009F +# Commonly misinterpreted as additional graphic characters +# The next line may appear to be blank, mojibake, or dingbats in some viewers +_ +_ +# Whitespace_ all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL) +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR) +# The next line may appear to be blank or mojibake in some viewers +# The next line may be flagged for _trailing whitespace_ in some viewers +​ +_ +# Unicode additional control characters_ all of the characters with +# general category Cf (in Unicode 8.0.0) +# The next line may appear to be blank or mojibake in some viewers +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏_____⁠⁡⁢⁣⁤____𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹 +_ +# _Byte order marks_, U+FEFF and U+FFFE, each on its own line +# The next two lines may appear to be blank or mojibake in some viewers + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g. smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript_Superscript_Accents +# +# Strings which contain unicode subscripts_superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +_ +'' +_ +'_' +''''_' +'_'_'''' +foo val=“bar” +foo val=“bar” +foo val=”bar“ +foo val=`bar' +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters_ can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters_ can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team_ can effectively cause rendering issues or character-length issues to validate product globalization readiness +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit_ https___twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +ﾛ(,_,_) +・(￣∀￣)・ +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +。・___・゜’( ☻ ω ☻ )。・___・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯__(ツ)__¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر ا +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛ ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http___www.unicode.org_charts_PDF_U2000.pdf) +_ +test +test +test +test⁠test +test +_ +# Zalgo Text +# +# Strings which contain _corrupted_ text. The corruption will not appear in non-HTML text, however. (via http___www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖̦̻͢.̛̖̞ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰̲͙ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹̼̣ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an _upsidedown_ effect (via http___www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$ +_ +# Unicode font +# +# Strings which contain bold_italic_etc. versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +script_alert(0)__script +<script>alert('1');<_script> +img src=x onerror=alert(2) +svg__script_123_1_alert(3)__script +script_alert(4)__script +'__script_alert(5)__script +script_alert(6)__script +script__script_alert(7)__script +script __ script _alert(8)_ _ script +onfocus=JaVaSCript_alert(9) autofocus +onfocus=JaVaSCript_alert(10) autofocus +' onfocus=JaVaSCript_alert(11) autofocus +＜script＞alert(12)＜_script＞ +sc_script_ript_alert(13)__sc__script_ript +script_alert(14)__script +alert(15);t= +';alert(16);t=' +JavaSCript_alert(17) +alert(18) +src=JaVaSCript_prompt(19) +script_alert(20);__script x= +'__script_alert(21);__script x=' +script_alert(22);__script x= +autofocus onkeyup=_javascript_alert(23) +' autofocus onkeyup='javascript_alert(24) +script_x20type=_text_javascript__javascript_alert(25);__script +script_x3Etype=_text_javascript__javascript_alert(26);__script +script_x0Dtype=_text_javascript__javascript_alert(27);__script +script_x09type=_text_javascript__javascript_alert(28);__script +script_x0Ctype=_text_javascript__javascript_alert(29);__script +script_x2Ftype=_text_javascript__javascript_alert(30);__script +script_x0Atype=_text_javascript__javascript_alert(31);__script +'`____x3Cscript_javascript_alert(32)__script +'`____x00script_javascript_alert(33)__script +ABC_div style=_x_x3Aexpression(javascript_alert(34)__DEF +ABC_div style=_x_expression_x5C(javascript_alert(35)__DEF +ABC_div style=_x_expression_x00(javascript_alert(36)__DEF +ABC_div style=_x_exp_x00ression(javascript_alert(37)__DEF +ABC_div style=_x_exp_x5Cression(javascript_alert(38)__DEF +ABC_div style=_x__x0Aexpression(javascript_alert(39)__DEF +ABC_div style=_x__x09expression(javascript_alert(40)__DEF +ABC_div style=_x__xE3_x80_x80expression(javascript_alert(41)__DEF +ABC_div style=_x__xE2_x80_x84expression(javascript_alert(42)__DEF +ABC_div style=_x__xC2_xA0expression(javascript_alert(43)__DEF +ABC_div style=_x__xE2_x80_x80expression(javascript_alert(44)__DEF +ABC_div style=_x__xE2_x80_x8Aexpression(javascript_alert(45)__DEF +ABC_div style=_x__x0Dexpression(javascript_alert(46)__DEF +ABC_div style=_x__x0Cexpression(javascript_alert(47)__DEF +ABC_div style=_x__xE2_x80_x87expression(javascript_alert(48)__DEF +ABC_div style=_x__xEF_xBB_xBFexpression(javascript_alert(49)__DEF +ABC_div style=_x__x20expression(javascript_alert(50)__DEF +ABC_div style=_x__xE2_x80_x88expression(javascript_alert(51)__DEF +ABC_div style=_x__x00expression(javascript_alert(52)__DEF +ABC_div style=_x__xE2_x80_x8Bexpression(javascript_alert(53)__DEF +ABC_div style=_x__xE2_x80_x86expression(javascript_alert(54)__DEF +ABC_div style=_x__xE2_x80_x85expression(javascript_alert(55)__DEF +ABC_div style=_x__xE2_x80_x82expression(javascript_alert(56)__DEF +ABC_div style=_x__x0Bexpression(javascript_alert(57)__DEF +ABC_div style=_x__xE2_x80_x81expression(javascript_alert(58)__DEF +ABC_div style=_x__xE2_x80_x83expression(javascript_alert(59)__DEF +ABC_div style=_x__xE2_x80_x89expression(javascript_alert(60)__DEF +a href=__x0Bjavascript_javascript_alert(61)_ id=_fuzzelement1__test__a +a href=__x0Fjavascript_javascript_alert(62)_ id=_fuzzelement1__test__a +a href=__xC2_xA0javascript_javascript_alert(63)_ id=_fuzzelement1__test__a +a href=__x05javascript_javascript_alert(64)_ id=_fuzzelement1__test__a +a href=__xE1_xA0_x8Ejavascript_javascript_alert(65)_ id=_fuzzelement1__test__a +a href=__x18javascript_javascript_alert(66)_ id=_fuzzelement1__test__a +a href=__x11javascript_javascript_alert(67)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x88javascript_javascript_alert(68)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x89javascript_javascript_alert(69)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x80javascript_javascript_alert(70)_ id=_fuzzelement1__test__a +a href=__x17javascript_javascript_alert(71)_ id=_fuzzelement1__test__a +a href=__x03javascript_javascript_alert(72)_ id=_fuzzelement1__test__a +a href=__x0Ejavascript_javascript_alert(73)_ id=_fuzzelement1__test__a +a href=__x1Ajavascript_javascript_alert(74)_ id=_fuzzelement1__test__a +a href=__x00javascript_javascript_alert(75)_ id=_fuzzelement1__test__a +a href=__x10javascript_javascript_alert(76)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x82javascript_javascript_alert(77)_ id=_fuzzelement1__test__a +a href=__x20javascript_javascript_alert(78)_ id=_fuzzelement1__test__a +a href=__x13javascript_javascript_alert(79)_ id=_fuzzelement1__test__a +a href=__x09javascript_javascript_alert(80)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x8Ajavascript_javascript_alert(81)_ id=_fuzzelement1__test__a +a href=__x14javascript_javascript_alert(82)_ id=_fuzzelement1__test__a +a href=__x19javascript_javascript_alert(83)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xAFjavascript_javascript_alert(84)_ id=_fuzzelement1__test__a +a href=__x1Fjavascript_javascript_alert(85)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x81javascript_javascript_alert(86)_ id=_fuzzelement1__test__a +a href=__x1Djavascript_javascript_alert(87)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x87javascript_javascript_alert(88)_ id=_fuzzelement1__test__a +a href=__x07javascript_javascript_alert(89)_ id=_fuzzelement1__test__a +a href=__xE1_x9A_x80javascript_javascript_alert(90)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x83javascript_javascript_alert(91)_ id=_fuzzelement1__test__a +a href=__x04javascript_javascript_alert(92)_ id=_fuzzelement1__test__a +a href=__x01javascript_javascript_alert(93)_ id=_fuzzelement1__test__a +a href=__x08javascript_javascript_alert(94)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x84javascript_javascript_alert(95)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x86javascript_javascript_alert(96)_ id=_fuzzelement1__test__a +a href=__xE3_x80_x80javascript_javascript_alert(97)_ id=_fuzzelement1__test__a +a href=__x12javascript_javascript_alert(98)_ id=_fuzzelement1__test__a +a href=__x0Djavascript_javascript_alert(99)_ id=_fuzzelement1__test__a +a href=__x0Ajavascript_javascript_alert(100)_ id=_fuzzelement1__test__a +a href=__x0Cjavascript_javascript_alert(101)_ id=_fuzzelement1__test__a +a href=__x15javascript_javascript_alert(102)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xA8javascript_javascript_alert(103)_ id=_fuzzelement1__test__a +a href=__x16javascript_javascript_alert(104)_ id=_fuzzelement1__test__a +a href=__x02javascript_javascript_alert(105)_ id=_fuzzelement1__test__a +a href=__x1Bjavascript_javascript_alert(106)_ id=_fuzzelement1__test__a +a href=__x06javascript_javascript_alert(107)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xA9javascript_javascript_alert(108)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x85javascript_javascript_alert(109)_ id=_fuzzelement1__test__a +a href=__x1Ejavascript_javascript_alert(110)_ id=_fuzzelement1__test__a +a href=__xE2_x81_x9Fjavascript_javascript_alert(111)_ id=_fuzzelement1__test__a +a href=__x1Cjavascript_javascript_alert(112)_ id=_fuzzelement1__test__a +a href=_javascript_x00_javascript_alert(113)_ id=_fuzzelement1__test__a +a href=_javascript_x3A_javascript_alert(114)_ id=_fuzzelement1__test__a +a href=_javascript_x09_javascript_alert(115)_ id=_fuzzelement1__test__a +a href=_javascript_x0D_javascript_alert(116)_ id=_fuzzelement1__test__a +a href=_javascript_x0A_javascript_alert(117)_ id=_fuzzelement1__test__a +`_'__img src=xxx_x _x0Aonerror=javascript_alert(118) +`_'__img src=xxx_x _x22onerror=javascript_alert(119) +`_'__img src=xxx_x _x0Bonerror=javascript_alert(120) +`_'__img src=xxx_x _x0Donerror=javascript_alert(121) +`_'__img src=xxx_x _x2Fonerror=javascript_alert(122) +`_'__img src=xxx_x _x09onerror=javascript_alert(123) +`_'__img src=xxx_x _x0Conerror=javascript_alert(124) +`_'__img src=xxx_x _x00onerror=javascript_alert(125) +`_'__img src=xxx_x _x27onerror=javascript_alert(126) +`_'__img src=xxx_x _x20onerror=javascript_alert(127) +`'__script__x3Bjavascript_alert(128)__script +`'__script__x0Djavascript_alert(129)__script +`'__script__xEF_xBB_xBFjavascript_alert(130)__script +`'__script__xE2_x80_x81javascript_alert(131)__script +`'__script__xE2_x80_x84javascript_alert(132)__script +`'__script__xE3_x80_x80javascript_alert(133)__script +`'__script__x09javascript_alert(134)__script +`'__script__xE2_x80_x89javascript_alert(135)__script +`'__script__xE2_x80_x85javascript_alert(136)__script +`'__script__xE2_x80_x88javascript_alert(137)__script +`'__script__x00javascript_alert(138)__script +`'__script__xE2_x80_xA8javascript_alert(139)__script +`'__script__xE2_x80_x8Ajavascript_alert(140)__script +`'__script__xE1_x9A_x80javascript_alert(141)__script +`'__script__x0Cjavascript_alert(142)__script +`'__script__x2Bjavascript_alert(143)__script +`'__script__xF0_x90_x96_x9Ajavascript_alert(144)__script +`'__script_-javascript_alert(145)__script +`'__script__x0Ajavascript_alert(146)__script +`'__script__xE2_x80_xAFjavascript_alert(147)__script +`'__script__x7Ejavascript_alert(148)__script +`'__script__xE2_x80_x87javascript_alert(149)__script +`'__script__xE2_x81_x9Fjavascript_alert(150)__script +`'__script__xE2_x80_xA9javascript_alert(151)__script +`'__script__xC2_x85javascript_alert(152)__script +`'__script__xEF_xBF_xAEjavascript_alert(153)__script +`'__script__xE2_x80_x83javascript_alert(154)__script +`'__script__xE2_x80_x8Bjavascript_alert(155)__script +`'__script__xEF_xBF_xBEjavascript_alert(156)__script +`'__script__xE2_x80_x80javascript_alert(157)__script +`'__script__x21javascript_alert(158)__script +`'__script__xE2_x80_x82javascript_alert(159)__script +`'__script__xE2_x80_x86javascript_alert(160)__script +`'__script__xE1_xA0_x8Ejavascript_alert(161)__script +`'__script__x0Bjavascript_alert(162)__script +`'__script__x20javascript_alert(163)__script +`'__script__xC2_xA0javascript_alert(164)__script +img _x00src=x onerror=_alert(165) +img _x47src=x onerror=_javascript_alert(166) +img _x11src=x onerror=_javascript_alert(167) +img _x12src=x onerror=_javascript_alert(168) +img_x47src=x onerror=_javascript_alert(169) +img_x10src=x onerror=_javascript_alert(170) +img_x13src=x onerror=_javascript_alert(171) +img_x32src=x onerror=_javascript_alert(172) +img_x47src=x onerror=_javascript_alert(173) +img_x11src=x onerror=_javascript_alert(174) +img _x47src=x onerror=_javascript_alert(175) +img _x34src=x onerror=_javascript_alert(176) +img _x39src=x onerror=_javascript_alert(177) +img _x00src=x onerror=_javascript_alert(178) +img src_x09=x onerror=_javascript_alert(179) +img src_x10=x onerror=_javascript_alert(180) +img src_x13=x onerror=_javascript_alert(181) +img src_x32=x onerror=_javascript_alert(182) +img src_x12=x onerror=_javascript_alert(183) +img src_x11=x onerror=_javascript_alert(184) +img src_x00=x onerror=_javascript_alert(185) +img src_x47=x onerror=_javascript_alert(186) +img src=x_x09onerror=_javascript_alert(187) +img src=x_x10onerror=_javascript_alert(188) +img src=x_x11onerror=_javascript_alert(189) +img src=x_x12onerror=_javascript_alert(190) +img src=x_x13onerror=_javascript_alert(191) +img[a][b][c]src[d]=x[e]onerror=[f]_alert(192) +img src=x onerror=_x09_javascript_alert(193) +img src=x onerror=_x10_javascript_alert(194) +img src=x onerror=_x11_javascript_alert(195) +img src=x onerror=_x12_javascript_alert(196) +img src=x onerror=_x32_javascript_alert(197) +img src=x onerror=_x00_javascript_alert(198) +a href=java script_javascript_alert(199)_XXX__a +img src=_x` `_script_javascript_alert(200)__script__` ` +img src onerror __ '_= alt=javascript_alert(201) +title onpropertychange=javascript_alert(202)___title__title title= +a href=http___foo.bar_#x=`y___a__img alt=_`__img src=x_x onerror=javascript_alert(203)___a +!--[if]__script_javascript_alert(204)__script +!--[if_img src=x onerror=javascript_alert(205)__] +script src=___%(jscript)s____script +script src=___%(jscript)s____script +IMG _____SCRIPT_alert(_206_)__SCRIPT +IMG SRC=javascript_alert(String.fromCharCode(50,48,55)) +IMG SRC=# onmouseover=_alert('208') +IMG SRC= onmouseover=_alert('209') +IMG onmouseover=_alert('210') +IMG SRC=javascript:alert('211') +IMG SRC=javascript:alert('212') +IMG SRC=javascript:alert('213') +IMG SRC=_jav ascript_alert('214') +IMG SRC=_jav ascript_alert('215') +IMG SRC=_jav ascript_alert('216') +IMG SRC=_jav ascript_alert('217') +perl -e 'print __IMG SRC=java_0script_alert(__218__)__;' _ out +IMG SRC=_  javascript_alert('219') +SCRIPT_XSS SRC=_http___ha.ckers.org_xss.js____SCRIPT +BODY onload!#$%&()_~+-_.,_;_@[___]^`=alert(_220_) +SCRIPT_SRC=_http___ha.ckers.org_xss.js____SCRIPT +SCRIPT_alert(_221_);_____SCRIPT +SCRIPT SRC=http___ha.ckers.org_xss.js__ B +SCRIPT SRC=__ha.ckers.org_.j +IMG SRC=_javascript_alert('222') +iframe src=http___ha.ckers.org_scriptlet.html +alert('223') +u oncopy=alert()_ Copy me__u +i onwheel=alert(224)_ Scroll over me __i +plaintext +http___a_%%30%30 +textarea__script_alert(225)__script +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE _' +_ +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https___news.ycombinator.com_item_id=7665153) +_ +_ +_ +version +help +$USER +dev_null; touch _tmp_blns.fail ; echo +`touch _tmp_blns.fail` +$(touch _tmp_blns.fail) +@{[system _touch _tmp_blns.fail_]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby_Rails applications +_ +eval(_puts 'hello world'_) +System(_ls -al __) +`ls -al _` +Kernel.exec(_ls -al __) +Kernel.exit(1) +%x('ls -al _') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +xml version=_1.0_ encoding=_ISO-8859-1____!DOCTYPE foo [ _!ELEMENT foo ANY __!ENTITY xxe SYSTEM _file____etc_passwd_ _]__foo_&xxe;__foo +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repre +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%_._s +%@ +%n +File +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +etc_passwd%00 +etc_hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch _tmp_blns.shellshock1.fail +() { _; } __[$($())] { touch _tmp_blns.shellshock2.fail; } +%s(un='%s') = %u ++++ATH0 +_ +# MSDOS_Windows Special Filenames +# +# Strings which are reserved characters in MSDOS_Windows +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A +ZZ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https___en.wikipedia.org_wiki_Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http___www.cum.qc.ca +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat_type on this file +_ +Roses are _[0;31mred_[0m, violets are _[0;34mblue. Hope you enjoy terminal hue +But now..._[20Cfor my greatest trick..._[8m +The quic______k brown fo___________x... [Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise _MemoryError_ exception +# second, obviously, prints contents of _etc_passwd +_ +{% print 'x' _ 64 _ 1024__3 %} +{{ __.__class__.__mro__[2].__subclasses__()[40](__etc_passwd_).read() }} diff --git a/tests/blns.no-windows_safe.capacity b/tests/blns.no-windows_safe.capacity new file mode 100644 index 0000000..0614b7b --- /dev/null +++ b/tests/blns.no-windows_safe.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +1 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +1 +17 +1 +45 +1 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +1 +20 +1 +76 +78 +1 +10 +10 +12 +1 +75 +18 +74 +72 +18 +67 +27 +1 +78 +59 +78 +62 +1 +75 +75 +76 +41 +59 +42 +67 +73 +62 +1 +67 +41 +67 +255 +1 +62 +72 +3 +3 +1 +17 +1 +66 +1 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +1 +39 +1 +83 +1 +9 +9 +18 +255 +1 +17 +1 +76 +1 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +1 +21 +1 +98 +1 +33 +33 +12 +9 +31 +56 +30 +15 +28 +1 +130 +1 +227 +1 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +1 +43 +1 +33 +1 +68 +60 +1 +2 +2 +1 +20 +1 +81 +1 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +1 +7 +1 +97 +1 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +1 +34 +1 +70 +53 +1 +41 +36 +24 +1 +17 +1 +101 +1 +9 +6 +1 +23 +1 +90 +1 +256 +111 +47 +3 +3 +224 +35 +1 +12 +1 +95 +1 +45 +57 +1 +15 +1 +136 +1 +13 +10 +10 +14 +10 +1 +12 +1 +126 +1 +264 +260 +258 +258 +51 +1 +20 +1 +95 +1 +192 +8 +1 +14 +1 +70 +1 +113 +148 +148 +148 +148 +148 +148 +113 +1 +18 +1 +87 +1 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +1 +15 +1 +69 +1 +18 +24 +13 +11 +44 +1 +1 +1 +1 +23 +1 +125 +1 +1 +2 +9 +6 +5 +38 +22 +23 +34 +1 +26 +1 +71 +1 +26 +18 +10 +23 +14 +14 +1 +26 +1 +83 +1 +138 +1 +24 +1 +256 +1 +5 +12 +2 +10 +3 +5 +2 +2 +8 +1 +16 +1 +89 +1 +46 +42 +1 +32 +1 +45 +1 +44 +58 +20 +7 +1 +33 +1 +56 +1 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +1 +24 +1 +79 +1 +29 +1 +20 +1 +112 +1 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +1 +17 +1 +56 +1 +211 +1 +23 +1 +62 +1 +78 +43 +48 +1 +21 +1 +59 +1 +61 +12 +15 +1 +28 +1 +87 +1 +8 +1 +18 +1 +56 +51 +1 +30 +72 diff --git a/tests/blns.no-windows_safe.sanitised b/tests/blns.no-windows_safe.sanitised new file mode 100644 index 0000000..8e4a261 --- /dev/null +++ b/tests/blns.no-windows_safe.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1_0 +0_0 +2147483648_-1 +9223372036854775808_-1 +0 +0.0 ++0 ++0.0 +0.00 +0.0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +1 +_ +_ +_ +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation.All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +.'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ +_ +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g.XML) +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. +_ +_ +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +_ +_ +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL) +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. +​ +_ +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏_____⁠⁡⁢⁣⁤____𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹 +_ +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g.smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript_Superscript_Accents +# +# Strings which contain unicode subscripts_superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" +<foo val=“bar” _> +<foo val=“bar” _> +<foo val=”bar“ _> +<foo val=`bar' _> +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters: can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit: https:__twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)__¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g.Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر. +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛ ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http:__www.unicode.org_charts_PDF_U2000.pdf) +_ +test +test +test +test⁠test +test +_ +# Zalgo Text +# +# Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http:__www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an "upsidedown" effect (via http:__www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$ +_ +# Unicode font +# +# Strings which contain bold_italic_etc.versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +<script>alert(0)<_script> +<script>alert('1');<_script> +<img src=x onerror=alert(2) _> +<svg><script>123<1>alert(3)<_script> +"><script>alert(4)<_script> +'><script>alert(5)<_script> +><script>alert(6)<_script> +<_script><script>alert(7)<_script> +< _ script >< script >alert(8)< _ script > +onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜_script＞ +<sc<script>ript>alert(13)<_sc<_script>ript> +><script>alert(14)<_script> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +alert(18) +src=JaVaSCript:prompt(19) +"><script>alert(20);<_script x=" +'><script>alert(21);<_script x=' +><script>alert(22);<_script x= +" autofocus onkeyup="javascript:alert(23) +' autofocus onkeyup='javascript:alert(24) +<script\x20type="text_javascript">javascript:alert(25);<_script> +<script\x3Etype="text_javascript">javascript:alert(26);<_script> +<script\x0Dtype="text_javascript">javascript:alert(27);<_script> +<script\x09type="text_javascript">javascript:alert(28);<_script> +<script\x0Ctype="text_javascript">javascript:alert(29);<_script> +<script\x2Ftype="text_javascript">javascript:alert(30);<_script> +<script\x0Atype="text_javascript">javascript:alert(31);<_script> +'`"><\x3Cscript>javascript:alert(32)<_script> +'`"><\x00script>javascript:alert(33)<_script> +ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF +ABC<div style="x:expression\x5C(javascript:alert(35)">DEF +ABC<div style="x:expression\x00(javascript:alert(36)">DEF +ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF +ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF +ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF +ABC<div style="x:\x09expression(javascript:alert(40)">DEF +ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF +ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF +ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF +ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF +ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF +ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF +ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF +ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF +ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF +ABC<div style="x:\x20expression(javascript:alert(50)">DEF +ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF +ABC<div style="x:\x00expression(javascript:alert(52)">DEF +ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF +ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF +ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF +ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF +ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF +ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF +ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF +ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF +<a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test<_a> +<a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test<_a> +<a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test<_a> +<a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test<_a> +<a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test<_a> +<a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test<_a> +<a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test<_a> +<a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test<_a> +<a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test<_a> +<a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test<_a> +<a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test<_a> +<a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test<_a> +<a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test<_a> +<a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test<_a> +<a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test<_a> +<a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test<_a> +<a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test<_a> +<a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test<_a> +<a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test<_a> +<a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test<_a> +<a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test<_a> +<a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test<_a> +<a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test<_a> +<a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test<_a> +<a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test<_a> +<a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test<_a> +<a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test<_a> +<a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test<_a> +<a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test<_a> +<a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test<_a> +<a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test<_a> +<a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test<_a> +<a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test<_a> +<a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test<_a> +<a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test<_a> +<a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test<_a> +<a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test<_a> +<a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test<_a> +<a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test<_a> +<a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test<_a> +<a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test<_a> +<a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test<_a> +<a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test<_a> +<a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test<_a> +`"'><img src=xxx:x \x0Aonerror=javascript:alert(118)> +`"'><img src=xxx:x \x22onerror=javascript:alert(119)> +`"'><img src=xxx:x \x0Bonerror=javascript:alert(120)> +`"'><img src=xxx:x \x0Donerror=javascript:alert(121)> +`"'><img src=xxx:x \x2Fonerror=javascript:alert(122)> +`"'><img src=xxx:x \x09onerror=javascript:alert(123)> +`"'><img src=xxx:x \x0Conerror=javascript:alert(124)> +`"'><img src=xxx:x \x00onerror=javascript:alert(125)> +`"'><img src=xxx:x \x27onerror=javascript:alert(126)> +`"'><img src=xxx:x \x20onerror=javascript:alert(127)> +"`'><script>\x3Bjavascript:alert(128)<_script> +"`'><script>\x0Djavascript:alert(129)<_script> +"`'><script>\xEF\xBB\xBFjavascript:alert(130)<_script> +"`'><script>\xE2\x80\x81javascript:alert(131)<_script> +"`'><script>\xE2\x80\x84javascript:alert(132)<_script> +"`'><script>\xE3\x80\x80javascript:alert(133)<_script> +"`'><script>\x09javascript:alert(134)<_script> +"`'><script>\xE2\x80\x89javascript:alert(135)<_script> +"`'><script>\xE2\x80\x85javascript:alert(136)<_script> +"`'><script>\xE2\x80\x88javascript:alert(137)<_script> +"`'><script>\x00javascript:alert(138)<_script> +"`'><script>\xE2\x80\xA8javascript:alert(139)<_script> +"`'><script>\xE2\x80\x8Ajavascript:alert(140)<_script> +"`'><script>\xE1\x9A\x80javascript:alert(141)<_script> +"`'><script>\x0Cjavascript:alert(142)<_script> +"`'><script>\x2Bjavascript:alert(143)<_script> +"`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)<_script> +"`'><script>-javascript:alert(145)<_script> +"`'><script>\x0Ajavascript:alert(146)<_script> +"`'><script>\xE2\x80\xAFjavascript:alert(147)<_script> +"`'><script>\x7Ejavascript:alert(148)<_script> +"`'><script>\xE2\x80\x87javascript:alert(149)<_script> +"`'><script>\xE2\x81\x9Fjavascript:alert(150)<_script> +"`'><script>\xE2\x80\xA9javascript:alert(151)<_script> +"`'><script>\xC2\x85javascript:alert(152)<_script> +"`'><script>\xEF\xBF\xAEjavascript:alert(153)<_script> +"`'><script>\xE2\x80\x83javascript:alert(154)<_script> +"`'><script>\xE2\x80\x8Bjavascript:alert(155)<_script> +"`'><script>\xEF\xBF\xBEjavascript:alert(156)<_script> +"`'><script>\xE2\x80\x80javascript:alert(157)<_script> +"`'><script>\x21javascript:alert(158)<_script> +"`'><script>\xE2\x80\x82javascript:alert(159)<_script> +"`'><script>\xE2\x80\x86javascript:alert(160)<_script> +"`'><script>\xE1\xA0\x8Ejavascript:alert(161)<_script> +"`'><script>\x0Bjavascript:alert(162)<_script> +"`'><script>\x20javascript:alert(163)<_script> +"`'><script>\xC2\xA0javascript:alert(164)<_script> +<img \x00src=x onerror="alert(165)"> +<img \x47src=x onerror="javascript:alert(166)"> +<img \x11src=x onerror="javascript:alert(167)"> +<img \x12src=x onerror="javascript:alert(168)"> +<img\x47src=x onerror="javascript:alert(169)"> +<img\x10src=x onerror="javascript:alert(170)"> +<img\x13src=x onerror="javascript:alert(171)"> +<img\x32src=x onerror="javascript:alert(172)"> +<img\x47src=x onerror="javascript:alert(173)"> +<img\x11src=x onerror="javascript:alert(174)"> +<img \x47src=x onerror="javascript:alert(175)"> +<img \x34src=x onerror="javascript:alert(176)"> +<img \x39src=x onerror="javascript:alert(177)"> +<img \x00src=x onerror="javascript:alert(178)"> +<img src\x09=x onerror="javascript:alert(179)"> +<img src\x10=x onerror="javascript:alert(180)"> +<img src\x13=x onerror="javascript:alert(181)"> +<img src\x32=x onerror="javascript:alert(182)"> +<img src\x12=x onerror="javascript:alert(183)"> +<img src\x11=x onerror="javascript:alert(184)"> +<img src\x00=x onerror="javascript:alert(185)"> +<img src\x47=x onerror="javascript:alert(186)"> +<img src=x\x09onerror="javascript:alert(187)"> +<img src=x\x10onerror="javascript:alert(188)"> +<img src=x\x11onerror="javascript:alert(189)"> +<img src=x\x12onerror="javascript:alert(190)"> +<img src=x\x13onerror="javascript:alert(191)"> +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)"> +<img src=x onerror=\x09"javascript:alert(193)"> +<img src=x onerror=\x10"javascript:alert(194)"> +<img src=x onerror=\x11"javascript:alert(195)"> +<img src=x onerror=\x12"javascript:alert(196)"> +<img src=x onerror=\x32"javascript:alert(197)"> +<img src=x onerror=\x00"javascript:alert(198)"> +<a href=java script:javascript:alert(199)>XXX<_a> +<img src="x` `<script>javascript:alert(200)<_script>"` `> +<img src onerror _" '"= alt=javascript:alert(201)__"> +<title onpropertychange=javascript:alert(202)><_title><title title=> +<a href=http:__foo.bar_#x=`y><_a><img alt="`><img src=x:x onerror=javascript:alert(203)><_a>"> +<!--[if]><script>javascript:alert(204)<_script --> +<!--[if<img src=x onerror=javascript:alert(205)__]> --> +<script src="_\%(jscript)s"><_script> +<script src="\\%(jscript)s"><_script> +<IMG """><SCRIPT>alert("206")<_SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="  javascript:alert('219');"> +<SCRIPT_XSS SRC="http:__ha.ckers.org_xss.js"><_SCRIPT> +<BODY onload!#$%&()*~+.:;?@[_|\]^`=alert("220")> +<SCRIPT_SRC="http:__ha.ckers.org_xss.js"><_SCRIPT> +<<SCRIPT>alert("221");__<<_SCRIPT> +<SCRIPT SRC=http:__ha.ckers.org_xss.js?< B > +<SCRIPT SRC=__ha.ckers.org.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http:__ha.ckers.org_scriptlet.html < +\";alert('223') +<u oncopy=alert()> Copy me<_u> +<i onwheel=alert(224)> Scroll over me <_i> +<plaintext> +http:__a_%%30%30 +<_textarea><script>alert(225)<_script> +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?' +_ +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https:__news.ycombinator.com_item?id=7665153) +_ +_ +_ +version +help +$USER +dev_null; touch _tmp_blns.fail ; echo +`touch _tmp_blns.fail` +$(touch _tmp_blns.fail) +@{[system "touch _tmp_blns.fail"]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby_Rails applications +_ +eval("puts 'hello world'") +System("ls -al _") +`ls -al _` +Kernel.exec("ls -al _") +Kernel.exit(1) +%x('ls -al _') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:___etc_passwd" >]><foo>&xxe;<_foo> +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File: +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +.etc_passwd%00 +.etc_hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch _tmp_blns.shellshock1.fail +() { _; } >_[$($())] { touch _tmp_blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 +_ +# MSDOS_Windows Special Filenames +# +# Strings which are reserved characters in MSDOS_Windows +_ +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https:__en.wikipedia.org_wiki_Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http:__www.cum.qc.ca +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I.Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat_type on this file +_ +Roses are _[0;31mred_[0m, violets are _[0;34mblue.Hope you enjoy terminal hue +But now..._[20Cfor my greatest trick.[8m +The quic______k brown fo___________x.[Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of _etc_passwd +_ +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("_etc_passwd").read() }} diff --git a/tests/blns.passthrough.capacity b/tests/blns.passthrough.capacity new file mode 100644 index 0000000..212042f --- /dev/null +++ b/tests/blns.passthrough.capacity @@ -0,0 +1,742 @@ +18 +1 +45 +0 +9 +5 +4 +4 +6 +3 +3 +4 +5 +4 +5 +4 +5 +4 +14 +4 +11 +1 +2 +0 +17 +1 +45 +0 +1 +1 +4 +5 +3 +3 +4 +5 +2 +5 +6 +4 +4 +5 +6 +3 +3 +14 +23 +2 +4 +2 +4 +4 +4 +1 +5 +4 +4 +1 +5 +5 +7 +7 +7 +7 +3 +1 +2 +2 +96 +3 +8 +9 +3 +5 +6 +6 +6 +5 +3 +10 +18 +10 +39 +8 +8 +8 +12 +12 +12 +8 +8 +8 +12 +12 +12 +5 +2 +2 +23 +0 +20 +1 +76 +78 +0 +10 +10 +12 +0 +75 +18 +74 +72 +18 +67 +27 +0 +78 +59 +78 +62 +0 +75 +75 +76 +41 +59 +42 +67 +73 +62 +0 +67 +41 +67 +550 +0 +62 +72 +3 +3 +0 +17 +1 +66 +0 +25 +25 +28 +29 +21 +26 +29 +34 +12 +158 +20 +0 +39 +1 +83 +0 +9 +9 +18 +803 +0 +17 +1 +76 +0 +1 +1 +2 +2 +3 +8 +10 +21 +21 +21 +17 +0 +21 +1 +98 +0 +33 +33 +12 +9 +31 +56 +30 +15 +28 +0 +130 +0 +227 +0 +34 +1 +174 +1 +46 +42 +41 +45 +46 +48 +55 +57 +46 +59 +50 +50 +56 +55 +46 +56 +58 +0 +43 +0 +33 +1 +68 +60 +0 +2 +2 +0 +20 +1 +81 +0 +45 +19 +18 +11 +20 +44 +51 +31 +32 +25 +17 +13 +0 +7 +1 +97 +0 +4 +8 +73 +39 +19 +76 +52 +144 +39 +84 +0 +34 +1 +70 +53 +0 +41 +36 +24 +0 +17 +1 +101 +0 +9 +6 +0 +23 +1 +90 +0 +334 +111 +47 +3 +3 +224 +35 +0 +12 +1 +95 +0 +45 +57 +0 +15 +1 +136 +0 +13 +10 +10 +14 +10 +0 +12 +1 +126 +0 +381 +260 +391 +276 +51 +0 +20 +1 +95 +0 +192 +8 +0 +14 +1 +70 +0 +113 +148 +148 +148 +148 +148 +148 +113 +0 +18 +1 +87 +0 +25 +48 +30 +36 +27 +27 +26 +34 +42 +39 +40 +40 +34 +43 +29 +15 +15 +20 +11 +25 +32 +32 +30 +41 +41 +64 +64 +64 +64 +64 +64 +64 +45 +45 +56 +57 +57 +57 +57 +57 +57 +65 +65 +61 +65 +65 +57 +57 +65 +65 +57 +65 +57 +65 +65 +65 +65 +57 +65 +65 +65 +72 +72 +76 +72 +80 +72 +72 +80 +80 +80 +72 +72 +72 +72 +72 +72 +80 +72 +72 +72 +80 +72 +72 +80 +72 +80 +72 +80 +72 +80 +80 +72 +72 +72 +80 +80 +80 +72 +72 +73 +73 +73 +81 +73 +73 +73 +73 +81 +81 +73 +81 +73 +73 +73 +73 +73 +73 +53 +53 +53 +53 +53 +53 +53 +53 +53 +53 +46 +46 +54 +54 +54 +54 +46 +54 +54 +54 +46 +54 +54 +54 +46 +46 +58 +43 +46 +54 +46 +54 +54 +54 +50 +54 +54 +54 +54 +54 +46 +54 +54 +54 +46 +46 +50 +36 +47 +47 +47 +46 +46 +46 +46 +46 +46 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +47 +46 +46 +46 +46 +46 +48 +47 +47 +47 +47 +47 +47 +80 +57 +53 +68 +94 +50 +55 +37 +37 +40 +57 +38 +37 +32 +136 +217 +125 +40 +42 +42 +42 +62 +45 +54 +51 +50 +34 +44 +30 +34 +48 +18 +30 +42 +11 +16 +38 +0 +15 +1 +69 +0 +18 +24 +13 +11 +44 +1 +1 +1 +0 +23 +1 +125 +0 +1 +2 +9 +6 +5 +38 +22 +23 +34 +0 +26 +1 +71 +0 +26 +18 +10 +23 +14 +14 +0 +26 +1 +83 +0 +138 +0 +24 +1 +277 +0 +5 +12 +2 +10 +3 +5 +2 +2 +8 +0 +16 +1 +89 +0 +46 +42 +0 +32 +1 +45 +0 +44 +58 +20 +7 +0 +33 +1 +56 +0 +3 +3 +3 +6 +3 +2 +3 +4 +4 +4 +4 +4 +4 +4 +0 +24 +1 +79 +0 +29 +0 +20 +1 +112 +0 +27 +26 +23 +15 +15 +17 +20 +21 +35 +14 +22 +15 +14 +29 +8 +5 +10 +13 +7 +9 +13 +8 +0 +17 +1 +56 +0 +211 +0 +23 +1 +62 +0 +78 +43 +48 +0 +21 +1 +59 +0 +61 +12 +15 +0 +28 +1 +87 +0 +8 +0 +18 +1 +56 +51 +0 +30 +72 diff --git a/tests/blns.passthrough.sanitised b/tests/blns.passthrough.sanitised new file mode 100644 index 0000000..7c27bbd --- /dev/null +++ b/tests/blns.passthrough.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code + +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ + +# Numeric Strings +# +# Strings which can be interpreted as numeric + +0 +1 +1.00 +$1.00 +1/2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1/2 +-1E2 +-1E02 +-1E+02 +1/0 +0/0 +-2147483648/-1 +-9223372036854775808/-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0..0 +. +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0/0 +1.0/0.0 +0.0/0.0 +1,0/0,0 +0,0/0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1#INF +-1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 + +# Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. + +,./;'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ + +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F, +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML), +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. + + +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ + +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL), +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. + …             ​

  　 + +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹󠀺󠀻󠀼󠀽󠀾󠀿󠁀󠁁󠁂󠁃󠁄󠁅󠁆󠁇󠁈󠁉󠁊󠁋󠁌󠁍󠁎󠁏󠁐󠁑󠁒󠁓󠁔󠁕󠁖󠁗󠁘󠁙󠁚󠁛󠁜󠁝󠁞󠁟󠁠󠁡󠁢󠁣󠁤󠁥󠁦󠁧󠁨󠁩󠁪󠁫󠁬󠁭󠁮󠁯󠁰󠁱󠁲󠁳󠁴󠁵󠁶󠁷󠁸󠁹󠁺󠁻󠁼󠁽󠁾󠁿 + +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ + +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g. smart quotes) + +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ + +# Unicode Subscript/Superscript/Accents +# +# Strings which contain unicode subscripts/superscripts; can cause rendering issues + +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ + +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors + +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" +<foo val=“bar” /> +<foo val=“bar” /> +<foo val=”bar“ /> +<foo val=`bar' /> + +# Two-Byte Characters +# +# Strings which contain two-byte characters: can cause rendering issues or character-length issues + +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 + +# Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character + +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 + +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) + +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 + +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit: https://twitter.com/jifa/status/625776454479970304 + +Ⱥ +Ⱦ + +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web + +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)_/¯ + +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always + +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 + +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors + +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 + +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric + +１２３ +١٢٣ + +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) + +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر الحدود أي بعد, معاملة بولندا، الإطلاق عل إيو. +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) + +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. + +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ + +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf) + +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ + +# Zalgo Text +# +# Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net) + +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ͏͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖̦̻͢.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰̲͙̻̝f ̪̰̰̗̖̭̘͘c̦͍̲̞͍̩̙ḥ͚a̮͎̟̙͜ơ̩̹͎s̤.̝̝ ҉Z̡̖̜͖̰̣͉̜a͖̰͙̬͡l̲̫̳͍̩g̡̟̼̱͚̞̬ͅo̗͜.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹̼̣l̴͔̰̤̟͔ḽ̫.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ + +# Unicode Upsidedown +# +# Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com) + +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$- + +# Unicode font +# +# Strings which contain bold/italic/etc. versions of normal characters + +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ + +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS + +<script>alert(0)</script> +<script>alert('1');</script> +<img src=x onerror=alert(2) /> +<svg><script>123<1>alert(3)</script> +"><script>alert(4)</script> +'><script>alert(5)</script> +><script>alert(6)</script> +</script><script>alert(7)</script> +< / script >< script >alert(8)< / script > + onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜/script＞ +<sc<script>ript>alert(13)</sc</script>ript> +--><script>alert(14)</script> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +;alert(18); +src=JaVaSCript:prompt(19) +"><script>alert(20);</script x=" +'><script>alert(21);</script x=' +><script>alert(22);</script x= +" autofocus onkeyup="javascript:alert(23) +' autofocus onkeyup='javascript:alert(24) +<script\x20type="text/javascript">javascript:alert(25);</script> +<script\x3Etype="text/javascript">javascript:alert(26);</script> +<script\x0Dtype="text/javascript">javascript:alert(27);</script> +<script\x09type="text/javascript">javascript:alert(28);</script> +<script\x0Ctype="text/javascript">javascript:alert(29);</script> +<script\x2Ftype="text/javascript">javascript:alert(30);</script> +<script\x0Atype="text/javascript">javascript:alert(31);</script> +'`"><\x3Cscript>javascript:alert(32)</script> +'`"><\x00script>javascript:alert(33)</script> +ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF +ABC<div style="x:expression\x5C(javascript:alert(35)">DEF +ABC<div style="x:expression\x00(javascript:alert(36)">DEF +ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF +ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF +ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF +ABC<div style="x:\x09expression(javascript:alert(40)">DEF +ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF +ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF +ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF +ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF +ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF +ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF +ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF +ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF +ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF +ABC<div style="x:\x20expression(javascript:alert(50)">DEF +ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF +ABC<div style="x:\x00expression(javascript:alert(52)">DEF +ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF +ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF +ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF +ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF +ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF +ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF +ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF +ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF +<a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test</a> +<a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test</a> +<a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test</a> +<a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test</a> +<a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test</a> +<a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test</a> +<a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test</a> +<a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test</a> +<a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test</a> +<a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test</a> +<a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test</a> +<a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test</a> +<a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test</a> +<a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test</a> +<a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test</a> +<a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test</a> +<a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test</a> +<a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test</a> +<a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test</a> +<a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test</a> +<a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test</a> +<a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test</a> +<a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test</a> +<a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test</a> +<a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test</a> +<a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test</a> +<a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test</a> +<a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test</a> +<a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test</a> +<a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test</a> +<a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test</a> +<a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test</a> +<a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test</a> +<a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test</a> +<a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test</a> +<a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test</a> +<a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test</a> +<a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test</a> +<a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test</a> +<a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test</a> +<a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test</a> +<a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test</a> +<a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test</a> +`"'><img src=xxx:x \x0Aonerror=javascript:alert(118)> +`"'><img src=xxx:x \x22onerror=javascript:alert(119)> +`"'><img src=xxx:x \x0Bonerror=javascript:alert(120)> +`"'><img src=xxx:x \x0Donerror=javascript:alert(121)> +`"'><img src=xxx:x \x2Fonerror=javascript:alert(122)> +`"'><img src=xxx:x \x09onerror=javascript:alert(123)> +`"'><img src=xxx:x \x0Conerror=javascript:alert(124)> +`"'><img src=xxx:x \x00onerror=javascript:alert(125)> +`"'><img src=xxx:x \x27onerror=javascript:alert(126)> +`"'><img src=xxx:x \x20onerror=javascript:alert(127)> +"`'><script>\x3Bjavascript:alert(128)</script> +"`'><script>\x0Djavascript:alert(129)</script> +"`'><script>\xEF\xBB\xBFjavascript:alert(130)</script> +"`'><script>\xE2\x80\x81javascript:alert(131)</script> +"`'><script>\xE2\x80\x84javascript:alert(132)</script> +"`'><script>\xE3\x80\x80javascript:alert(133)</script> +"`'><script>\x09javascript:alert(134)</script> +"`'><script>\xE2\x80\x89javascript:alert(135)</script> +"`'><script>\xE2\x80\x85javascript:alert(136)</script> +"`'><script>\xE2\x80\x88javascript:alert(137)</script> +"`'><script>\x00javascript:alert(138)</script> +"`'><script>\xE2\x80\xA8javascript:alert(139)</script> +"`'><script>\xE2\x80\x8Ajavascript:alert(140)</script> +"`'><script>\xE1\x9A\x80javascript:alert(141)</script> +"`'><script>\x0Cjavascript:alert(142)</script> +"`'><script>\x2Bjavascript:alert(143)</script> +"`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)</script> +"`'><script>-javascript:alert(145)</script> +"`'><script>\x0Ajavascript:alert(146)</script> +"`'><script>\xE2\x80\xAFjavascript:alert(147)</script> +"`'><script>\x7Ejavascript:alert(148)</script> +"`'><script>\xE2\x80\x87javascript:alert(149)</script> +"`'><script>\xE2\x81\x9Fjavascript:alert(150)</script> +"`'><script>\xE2\x80\xA9javascript:alert(151)</script> +"`'><script>\xC2\x85javascript:alert(152)</script> +"`'><script>\xEF\xBF\xAEjavascript:alert(153)</script> +"`'><script>\xE2\x80\x83javascript:alert(154)</script> +"`'><script>\xE2\x80\x8Bjavascript:alert(155)</script> +"`'><script>\xEF\xBF\xBEjavascript:alert(156)</script> +"`'><script>\xE2\x80\x80javascript:alert(157)</script> +"`'><script>\x21javascript:alert(158)</script> +"`'><script>\xE2\x80\x82javascript:alert(159)</script> +"`'><script>\xE2\x80\x86javascript:alert(160)</script> +"`'><script>\xE1\xA0\x8Ejavascript:alert(161)</script> +"`'><script>\x0Bjavascript:alert(162)</script> +"`'><script>\x20javascript:alert(163)</script> +"`'><script>\xC2\xA0javascript:alert(164)</script> +<img \x00src=x onerror="alert(165)"> +<img \x47src=x onerror="javascript:alert(166)"> +<img \x11src=x onerror="javascript:alert(167)"> +<img \x12src=x onerror="javascript:alert(168)"> +<img\x47src=x onerror="javascript:alert(169)"> +<img\x10src=x onerror="javascript:alert(170)"> +<img\x13src=x onerror="javascript:alert(171)"> +<img\x32src=x onerror="javascript:alert(172)"> +<img\x47src=x onerror="javascript:alert(173)"> +<img\x11src=x onerror="javascript:alert(174)"> +<img \x47src=x onerror="javascript:alert(175)"> +<img \x34src=x onerror="javascript:alert(176)"> +<img \x39src=x onerror="javascript:alert(177)"> +<img \x00src=x onerror="javascript:alert(178)"> +<img src\x09=x onerror="javascript:alert(179)"> +<img src\x10=x onerror="javascript:alert(180)"> +<img src\x13=x onerror="javascript:alert(181)"> +<img src\x32=x onerror="javascript:alert(182)"> +<img src\x12=x onerror="javascript:alert(183)"> +<img src\x11=x onerror="javascript:alert(184)"> +<img src\x00=x onerror="javascript:alert(185)"> +<img src\x47=x onerror="javascript:alert(186)"> +<img src=x\x09onerror="javascript:alert(187)"> +<img src=x\x10onerror="javascript:alert(188)"> +<img src=x\x11onerror="javascript:alert(189)"> +<img src=x\x12onerror="javascript:alert(190)"> +<img src=x\x13onerror="javascript:alert(191)"> +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)"> +<img src=x onerror=\x09"javascript:alert(193)"> +<img src=x onerror=\x10"javascript:alert(194)"> +<img src=x onerror=\x11"javascript:alert(195)"> +<img src=x onerror=\x12"javascript:alert(196)"> +<img src=x onerror=\x32"javascript:alert(197)"> +<img src=x onerror=\x00"javascript:alert(198)"> +<a href=java script:javascript:alert(199)>XXX</a> +<img src="x` `<script>javascript:alert(200)</script>"` `> +<img src onerror /" '"= alt=javascript:alert(201)//"> +<title onpropertychange=javascript:alert(202)> +<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>"> +<!--[if]><script>javascript:alert(204)</script --> +<!--[if<img src=x onerror=javascript:alert(205)//]> --> +<script src="/\%(jscript)s"></script> +<script src="\\%(jscript)s"></script> +<IMG """><SCRIPT>alert("206")</SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav   ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="   javascript:alert('219');"> +<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("220")> +<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<<SCRIPT>alert("221");//<</SCRIPT> +<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > +<SCRIPT SRC=//ha.ckers.org/.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http://ha.ckers.org/scriptlet.html < +\";alert('223');// +<u oncopy=alert()> Copy me</u> +<i onwheel=alert(224)> Scroll over me </i> +<plaintext> +http://a/%%30%30 +</textarea><script>alert(225)</script> + +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized + +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?'; -- + +% +_ + +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) + +- +-- +--version +--help +$USER +/dev/null; touch /tmp/blns.fail ; echo +`touch /tmp/blns.fail` +$(touch /tmp/blns.fail) +@{[system "touch /tmp/blns.fail"]} + +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby/Rails applications + +eval("puts 'hello world'") +System("ls -al /") +`ls -al /` +Kernel.exec("ls -al /") +Kernel.exit(1) +%x('ls -al /') + +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser + +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> + +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just represent the wrong string. + +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File:/// + +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server + +../../../../../../../../../../../etc/passwd%00 +../../../../../../../../../../../etc/hosts + +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities + +() { 0; }; touch /tmp/blns.shellshock1.fail; +() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 + +# MSDOS/Windows Special Filenames +# +# Strings which are reserved characters in MSDOS/Windows + +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 + +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out + +DCC SEND STARTKEYLOGGER 0 0 0 + +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) + +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http://www.cum.qc.ca/ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement + +# Human injection +# +# Strings which may cause human to reinterpret worldview + +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. + +# Terminal escape codes +# +# Strings which punish the fools who use cat/type on this file + +Roses are red, violets are blue. Hope you enjoy terminal hue +But now...for my greatest trick... +The quick brown fox... [Beeeep] + +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS + +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా + +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) + +گچپژ + +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of /etc/passwd + +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }} diff --git a/tests/blns.realistic-length_limit-reduction.capacity b/tests/blns.realistic-length_limit-reduction.capacity new file mode 100644 index 0000000..b0df831 --- /dev/null +++ b/tests/blns.realistic-length_limit-reduction.capacity @@ -0,0 +1,742 @@ +19 +2 +46 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +15 +5 +12 +2 +3 +1 +18 +2 +46 +1 +2 +2 +5 +5 +4 +4 +5 +6 +3 +5 +7 +5 +5 +6 +7 +4 +4 +15 +24 +3 +5 +3 +5 +5 +5 +1 +6 +5 +5 +2 +6 +5 +7 +7 +8 +8 +4 +2 +2 +3 +97 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +19 +11 +40 +8 +8 +8 +12 +12 +12 +8 +9 +9 +12 +13 +13 +6 +3 +3 +23 +1 +21 +2 +76 +78 +1 +10 +11 +13 +1 +76 +19 +74 +73 +18 +67 +28 +1 +78 +59 +78 +63 +1 +76 +75 +77 +41 +60 +42 +67 +73 +63 +1 +68 +41 +67 +252 +1 +62 +72 +4 +4 +1 +18 +2 +66 +1 +26 +26 +29 +30 +22 +27 +30 +35 +13 +159 +21 +1 +40 +2 +84 +1 +10 +10 +19 +252 +1 +18 +2 +77 +1 +2 +2 +3 +3 +4 +9 +11 +22 +22 +22 +18 +1 +22 +2 +99 +1 +34 +34 +13 +10 +32 +57 +31 +16 +29 +1 +131 +1 +228 +1 +35 +2 +174 +2 +47 +43 +42 +46 +47 +49 +56 +58 +47 +60 +51 +51 +57 +56 +47 +57 +59 +1 +44 +1 +34 +2 +69 +60 +1 +3 +3 +1 +21 +2 +82 +1 +46 +20 +19 +12 +21 +45 +52 +32 +33 +26 +18 +14 +1 +8 +2 +98 +1 +5 +9 +74 +40 +20 +77 +53 +145 +40 +85 +1 +35 +2 +71 +54 +1 +42 +37 +25 +1 +18 +2 +102 +1 +10 +7 +1 +24 +2 +90 +1 +252 +112 +48 +4 +4 +225 +36 +1 +13 +2 +95 +1 +46 +58 +1 +16 +2 +136 +1 +14 +11 +11 +15 +11 +1 +13 +2 +126 +1 +260 +260 +254 +254 +52 +1 +21 +2 +95 +1 +193 +9 +1 +15 +2 +70 +1 +114 +149 +149 +149 +149 +149 +149 +114 +1 +19 +2 +88 +1 +26 +49 +31 +37 +28 +28 +27 +35 +43 +40 +41 +41 +35 +44 +30 +16 +16 +21 +12 +26 +33 +33 +31 +42 +42 +65 +65 +65 +65 +65 +65 +65 +46 +46 +57 +58 +58 +58 +58 +58 +58 +66 +66 +62 +66 +66 +58 +58 +66 +66 +58 +66 +58 +66 +66 +66 +66 +58 +66 +66 +66 +73 +73 +77 +73 +81 +73 +73 +81 +81 +81 +73 +73 +73 +73 +73 +73 +81 +73 +73 +73 +81 +73 +73 +81 +73 +81 +73 +81 +73 +81 +81 +73 +73 +73 +81 +81 +81 +73 +73 +74 +74 +74 +82 +74 +74 +74 +74 +82 +82 +74 +82 +74 +74 +74 +74 +74 +74 +54 +54 +54 +54 +54 +54 +54 +54 +54 +54 +47 +47 +55 +55 +55 +55 +47 +55 +55 +55 +47 +55 +55 +55 +47 +47 +59 +44 +47 +55 +47 +55 +55 +55 +51 +55 +55 +55 +55 +55 +47 +55 +55 +55 +47 +47 +51 +37 +48 +48 +48 +47 +47 +47 +47 +47 +47 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +47 +47 +47 +47 +47 +49 +48 +48 +48 +48 +48 +48 +81 +58 +54 +69 +94 +51 +56 +38 +38 +41 +57 +39 +38 +33 +137 +218 +126 +41 +43 +43 +43 +63 +46 +54 +51 +50 +35 +44 +30 +35 +48 +19 +31 +43 +12 +17 +39 +1 +16 +2 +70 +1 +19 +25 +14 +12 +45 +2 +2 +2 +1 +24 +2 +125 +1 +2 +3 +10 +7 +6 +38 +22 +23 +34 +1 +27 +2 +72 +1 +27 +19 +11 +23 +14 +15 +1 +27 +2 +84 +1 +138 +1 +25 +2 +252 +1 +6 +13 +3 +11 +4 +5 +3 +3 +9 +1 +17 +2 +90 +1 +46 +42 +1 +33 +2 +46 +1 +44 +58 +21 +8 +1 +34 +2 +57 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +25 +2 +80 +1 +30 +1 +21 +2 +112 +1 +28 +27 +24 +16 +16 +18 +20 +21 +36 +15 +22 +16 +15 +30 +9 +6 +11 +14 +8 +10 +14 +9 +1 +18 +2 +57 +1 +211 +1 +24 +2 +63 +1 +78 +43 +48 +1 +22 +2 +60 +1 +62 +13 +16 +1 +29 +2 +88 +1 +9 +1 +19 +2 +57 +52 +1 +31 +72 diff --git a/tests/blns.realistic-length_limit-reduction.sanitised b/tests/blns.realistic-length_limit-reduction.sanitised new file mode 100644 index 0000000..31bb9f1 --- /dev/null +++ b/tests/blns.realistic-length_limit-reduction.sanitised @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +_ +_ +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1_0 +0_0 +2147483648_-1 +9223372036854775808_-1 +0 +0.0 ++0 ++0.0 +0.00 +0.0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +1 +_ +_ +_ +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation.All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +.'[]_-= +{}__+ +!@#$%^&_()`~ +_ +# Non-whitespace C0 controls_ U+0001 through U+0008, U+000E through U+001F +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g.XML) +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. +_ +_ +# Non-whitespace C1 controls_ U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +_ +_ +# Whitespace_ all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL) +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for _trailing whitespace_ in some viewers. +​ +_ +# Unicode additional control characters_ all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏_____⁠⁡⁢⁣⁤____𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸 +_ +# _Byte order marks_, U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g.smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript_Superscript_Accents +# +# Strings which contain unicode subscripts_superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +_ +'' +_ +'_' +''''_' +'_'_'''' +foo val=“bar” +foo val=“bar” +foo val=”bar“ +foo val=`bar' +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters_ can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters_ can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team_ can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit_ https___twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +ﾛ(,_,_) +・(￣∀￣)・ +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +。・___・゜’( ☻ ω ☻ )。・___・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯__(ツ)__¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g.Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذك. +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛ ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http___www.unicode.org_charts_PDF_U2000.pdf) +_ +test +test +test +test⁠test +test +_ +# Zalgo Text +# +# Strings which contain _corrupted_ text. The corruption will not appear in non-HTML text, however. (via http___www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an _upsidedown_ effect (via http___www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$ +_ +# Unicode font +# +# Strings which contain bold_italic_etc.versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +script_alert(0)__script +<script>alert('1');<_script> +img src=x onerror=alert(2) +svg__script_123_1_alert(3)__script +script_alert(4)__script +'__script_alert(5)__script +script_alert(6)__script +script__script_alert(7)__script +script __ script _alert(8)_ _ script +onfocus=JaVaSCript_alert(9) autofocus +onfocus=JaVaSCript_alert(10) autofocus +' onfocus=JaVaSCript_alert(11) autofocus +＜script＞alert(12)＜_script＞ +sc_script_ript_alert(13)__sc__script_ript +script_alert(14)__script +alert(15);t= +';alert(16);t=' +JavaSCript_alert(17) +alert(18) +src=JaVaSCript_prompt(19) +script_alert(20);__script x= +'__script_alert(21);__script x=' +script_alert(22);__script x= +autofocus onkeyup=_javascript_alert(23) +' autofocus onkeyup='javascript_alert(24) +script_x20type=_text_javascript__javascript_alert(25);__script +script_x3Etype=_text_javascript__javascript_alert(26);__script +script_x0Dtype=_text_javascript__javascript_alert(27);__script +script_x09type=_text_javascript__javascript_alert(28);__script +script_x0Ctype=_text_javascript__javascript_alert(29);__script +script_x2Ftype=_text_javascript__javascript_alert(30);__script +script_x0Atype=_text_javascript__javascript_alert(31);__script +'`____x3Cscript_javascript_alert(32)__script +'`____x00script_javascript_alert(33)__script +ABC_div style=_x_x3Aexpression(javascript_alert(34)__DEF +ABC_div style=_x_expression_x5C(javascript_alert(35)__DEF +ABC_div style=_x_expression_x00(javascript_alert(36)__DEF +ABC_div style=_x_exp_x00ression(javascript_alert(37)__DEF +ABC_div style=_x_exp_x5Cression(javascript_alert(38)__DEF +ABC_div style=_x__x0Aexpression(javascript_alert(39)__DEF +ABC_div style=_x__x09expression(javascript_alert(40)__DEF +ABC_div style=_x__xE3_x80_x80expression(javascript_alert(41)__DEF +ABC_div style=_x__xE2_x80_x84expression(javascript_alert(42)__DEF +ABC_div style=_x__xC2_xA0expression(javascript_alert(43)__DEF +ABC_div style=_x__xE2_x80_x80expression(javascript_alert(44)__DEF +ABC_div style=_x__xE2_x80_x8Aexpression(javascript_alert(45)__DEF +ABC_div style=_x__x0Dexpression(javascript_alert(46)__DEF +ABC_div style=_x__x0Cexpression(javascript_alert(47)__DEF +ABC_div style=_x__xE2_x80_x87expression(javascript_alert(48)__DEF +ABC_div style=_x__xEF_xBB_xBFexpression(javascript_alert(49)__DEF +ABC_div style=_x__x20expression(javascript_alert(50)__DEF +ABC_div style=_x__xE2_x80_x88expression(javascript_alert(51)__DEF +ABC_div style=_x__x00expression(javascript_alert(52)__DEF +ABC_div style=_x__xE2_x80_x8Bexpression(javascript_alert(53)__DEF +ABC_div style=_x__xE2_x80_x86expression(javascript_alert(54)__DEF +ABC_div style=_x__xE2_x80_x85expression(javascript_alert(55)__DEF +ABC_div style=_x__xE2_x80_x82expression(javascript_alert(56)__DEF +ABC_div style=_x__x0Bexpression(javascript_alert(57)__DEF +ABC_div style=_x__xE2_x80_x81expression(javascript_alert(58)__DEF +ABC_div style=_x__xE2_x80_x83expression(javascript_alert(59)__DEF +ABC_div style=_x__xE2_x80_x89expression(javascript_alert(60)__DEF +a href=__x0Bjavascript_javascript_alert(61)_ id=_fuzzelement1__test__a +a href=__x0Fjavascript_javascript_alert(62)_ id=_fuzzelement1__test__a +a href=__xC2_xA0javascript_javascript_alert(63)_ id=_fuzzelement1__test__a +a href=__x05javascript_javascript_alert(64)_ id=_fuzzelement1__test__a +a href=__xE1_xA0_x8Ejavascript_javascript_alert(65)_ id=_fuzzelement1__test__a +a href=__x18javascript_javascript_alert(66)_ id=_fuzzelement1__test__a +a href=__x11javascript_javascript_alert(67)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x88javascript_javascript_alert(68)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x89javascript_javascript_alert(69)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x80javascript_javascript_alert(70)_ id=_fuzzelement1__test__a +a href=__x17javascript_javascript_alert(71)_ id=_fuzzelement1__test__a +a href=__x03javascript_javascript_alert(72)_ id=_fuzzelement1__test__a +a href=__x0Ejavascript_javascript_alert(73)_ id=_fuzzelement1__test__a +a href=__x1Ajavascript_javascript_alert(74)_ id=_fuzzelement1__test__a +a href=__x00javascript_javascript_alert(75)_ id=_fuzzelement1__test__a +a href=__x10javascript_javascript_alert(76)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x82javascript_javascript_alert(77)_ id=_fuzzelement1__test__a +a href=__x20javascript_javascript_alert(78)_ id=_fuzzelement1__test__a +a href=__x13javascript_javascript_alert(79)_ id=_fuzzelement1__test__a +a href=__x09javascript_javascript_alert(80)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x8Ajavascript_javascript_alert(81)_ id=_fuzzelement1__test__a +a href=__x14javascript_javascript_alert(82)_ id=_fuzzelement1__test__a +a href=__x19javascript_javascript_alert(83)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xAFjavascript_javascript_alert(84)_ id=_fuzzelement1__test__a +a href=__x1Fjavascript_javascript_alert(85)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x81javascript_javascript_alert(86)_ id=_fuzzelement1__test__a +a href=__x1Djavascript_javascript_alert(87)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x87javascript_javascript_alert(88)_ id=_fuzzelement1__test__a +a href=__x07javascript_javascript_alert(89)_ id=_fuzzelement1__test__a +a href=__xE1_x9A_x80javascript_javascript_alert(90)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x83javascript_javascript_alert(91)_ id=_fuzzelement1__test__a +a href=__x04javascript_javascript_alert(92)_ id=_fuzzelement1__test__a +a href=__x01javascript_javascript_alert(93)_ id=_fuzzelement1__test__a +a href=__x08javascript_javascript_alert(94)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x84javascript_javascript_alert(95)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x86javascript_javascript_alert(96)_ id=_fuzzelement1__test__a +a href=__xE3_x80_x80javascript_javascript_alert(97)_ id=_fuzzelement1__test__a +a href=__x12javascript_javascript_alert(98)_ id=_fuzzelement1__test__a +a href=__x0Djavascript_javascript_alert(99)_ id=_fuzzelement1__test__a +a href=__x0Ajavascript_javascript_alert(100)_ id=_fuzzelement1__test__a +a href=__x0Cjavascript_javascript_alert(101)_ id=_fuzzelement1__test__a +a href=__x15javascript_javascript_alert(102)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xA8javascript_javascript_alert(103)_ id=_fuzzelement1__test__a +a href=__x16javascript_javascript_alert(104)_ id=_fuzzelement1__test__a +a href=__x02javascript_javascript_alert(105)_ id=_fuzzelement1__test__a +a href=__x1Bjavascript_javascript_alert(106)_ id=_fuzzelement1__test__a +a href=__x06javascript_javascript_alert(107)_ id=_fuzzelement1__test__a +a href=__xE2_x80_xA9javascript_javascript_alert(108)_ id=_fuzzelement1__test__a +a href=__xE2_x80_x85javascript_javascript_alert(109)_ id=_fuzzelement1__test__a +a href=__x1Ejavascript_javascript_alert(110)_ id=_fuzzelement1__test__a +a href=__xE2_x81_x9Fjavascript_javascript_alert(111)_ id=_fuzzelement1__test__a +a href=__x1Cjavascript_javascript_alert(112)_ id=_fuzzelement1__test__a +a href=_javascript_x00_javascript_alert(113)_ id=_fuzzelement1__test__a +a href=_javascript_x3A_javascript_alert(114)_ id=_fuzzelement1__test__a +a href=_javascript_x09_javascript_alert(115)_ id=_fuzzelement1__test__a +a href=_javascript_x0D_javascript_alert(116)_ id=_fuzzelement1__test__a +a href=_javascript_x0A_javascript_alert(117)_ id=_fuzzelement1__test__a +`_'__img src=xxx_x _x0Aonerror=javascript_alert(118) +`_'__img src=xxx_x _x22onerror=javascript_alert(119) +`_'__img src=xxx_x _x0Bonerror=javascript_alert(120) +`_'__img src=xxx_x _x0Donerror=javascript_alert(121) +`_'__img src=xxx_x _x2Fonerror=javascript_alert(122) +`_'__img src=xxx_x _x09onerror=javascript_alert(123) +`_'__img src=xxx_x _x0Conerror=javascript_alert(124) +`_'__img src=xxx_x _x00onerror=javascript_alert(125) +`_'__img src=xxx_x _x27onerror=javascript_alert(126) +`_'__img src=xxx_x _x20onerror=javascript_alert(127) +`'__script__x3Bjavascript_alert(128)__script +`'__script__x0Djavascript_alert(129)__script +`'__script__xEF_xBB_xBFjavascript_alert(130)__script +`'__script__xE2_x80_x81javascript_alert(131)__script +`'__script__xE2_x80_x84javascript_alert(132)__script +`'__script__xE3_x80_x80javascript_alert(133)__script +`'__script__x09javascript_alert(134)__script +`'__script__xE2_x80_x89javascript_alert(135)__script +`'__script__xE2_x80_x85javascript_alert(136)__script +`'__script__xE2_x80_x88javascript_alert(137)__script +`'__script__x00javascript_alert(138)__script +`'__script__xE2_x80_xA8javascript_alert(139)__script +`'__script__xE2_x80_x8Ajavascript_alert(140)__script +`'__script__xE1_x9A_x80javascript_alert(141)__script +`'__script__x0Cjavascript_alert(142)__script +`'__script__x2Bjavascript_alert(143)__script +`'__script__xF0_x90_x96_x9Ajavascript_alert(144)__script +`'__script_-javascript_alert(145)__script +`'__script__x0Ajavascript_alert(146)__script +`'__script__xE2_x80_xAFjavascript_alert(147)__script +`'__script__x7Ejavascript_alert(148)__script +`'__script__xE2_x80_x87javascript_alert(149)__script +`'__script__xE2_x81_x9Fjavascript_alert(150)__script +`'__script__xE2_x80_xA9javascript_alert(151)__script +`'__script__xC2_x85javascript_alert(152)__script +`'__script__xEF_xBF_xAEjavascript_alert(153)__script +`'__script__xE2_x80_x83javascript_alert(154)__script +`'__script__xE2_x80_x8Bjavascript_alert(155)__script +`'__script__xEF_xBF_xBEjavascript_alert(156)__script +`'__script__xE2_x80_x80javascript_alert(157)__script +`'__script__x21javascript_alert(158)__script +`'__script__xE2_x80_x82javascript_alert(159)__script +`'__script__xE2_x80_x86javascript_alert(160)__script +`'__script__xE1_xA0_x8Ejavascript_alert(161)__script +`'__script__x0Bjavascript_alert(162)__script +`'__script__x20javascript_alert(163)__script +`'__script__xC2_xA0javascript_alert(164)__script +img _x00src=x onerror=_alert(165) +img _x47src=x onerror=_javascript_alert(166) +img _x11src=x onerror=_javascript_alert(167) +img _x12src=x onerror=_javascript_alert(168) +img_x47src=x onerror=_javascript_alert(169) +img_x10src=x onerror=_javascript_alert(170) +img_x13src=x onerror=_javascript_alert(171) +img_x32src=x onerror=_javascript_alert(172) +img_x47src=x onerror=_javascript_alert(173) +img_x11src=x onerror=_javascript_alert(174) +img _x47src=x onerror=_javascript_alert(175) +img _x34src=x onerror=_javascript_alert(176) +img _x39src=x onerror=_javascript_alert(177) +img _x00src=x onerror=_javascript_alert(178) +img src_x09=x onerror=_javascript_alert(179) +img src_x10=x onerror=_javascript_alert(180) +img src_x13=x onerror=_javascript_alert(181) +img src_x32=x onerror=_javascript_alert(182) +img src_x12=x onerror=_javascript_alert(183) +img src_x11=x onerror=_javascript_alert(184) +img src_x00=x onerror=_javascript_alert(185) +img src_x47=x onerror=_javascript_alert(186) +img src=x_x09onerror=_javascript_alert(187) +img src=x_x10onerror=_javascript_alert(188) +img src=x_x11onerror=_javascript_alert(189) +img src=x_x12onerror=_javascript_alert(190) +img src=x_x13onerror=_javascript_alert(191) +img[a][b][c]src[d]=x[e]onerror=[f]_alert(192) +img src=x onerror=_x09_javascript_alert(193) +img src=x onerror=_x10_javascript_alert(194) +img src=x onerror=_x11_javascript_alert(195) +img src=x onerror=_x12_javascript_alert(196) +img src=x onerror=_x32_javascript_alert(197) +img src=x onerror=_x00_javascript_alert(198) +a href=java script_javascript_alert(199)_XXX__a +img src=_x` `_script_javascript_alert(200)__script__` ` +img src onerror __ '_= alt=javascript_alert(201) +title onpropertychange=javascript_alert(202)___title__title title= +a href=http___foo.bar_#x=`y___a__img alt=_`__img src=x_x onerror=javascript_alert(203)___a +!--[if]__script_javascript_alert(204)__script +!--[if_img src=x onerror=javascript_alert(205)__] +script src=___%(jscript)s____script +script src=___%(jscript)s____script +IMG _____SCRIPT_alert(_206_)__SCRIPT +IMG SRC=javascript_alert(String.fromCharCode(50,48,55)) +IMG SRC=# onmouseover=_alert('208') +IMG SRC= onmouseover=_alert('209') +IMG onmouseover=_alert('210') +IMG SRC=javascript:alert('211') +IMG SRC=javascript:alert('212') +IMG SRC=javascript:alert('213') +IMG SRC=_jav ascript_alert('214') +IMG SRC=_jav ascript_alert('215') +IMG SRC=_jav ascript_alert('216') +IMG SRC=_jav ascript_alert('217') +perl -e 'print __IMG SRC=java_0script_alert(__218__)__;' _ out +IMG SRC=_  javascript_alert('219') +SCRIPT_XSS SRC=_http___ha.ckers.org_xss.js____SCRIPT +BODY onload!#$%&()_~+.@[___]^`=alert(_220_) +SCRIPT_SRC=_http___ha.ckers.org_xss.js____SCRIPT +SCRIPT_alert(_221_);_____SCRIPT +SCRIPT SRC=http___ha.ckers.org_xss.js__ B +SCRIPT SRC=__ha.ckers.org.j +IMG SRC=_javascript_alert('222') +iframe src=http___ha.ckers.org_scriptlet.html +alert('223') +u oncopy=alert()_ Copy me__u +i onwheel=alert(224)_ Scroll over me __i +plaintext +http___a_%%30%30 +textarea__script_alert(225)__script +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE _' +_ +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https___news.ycombinator.com_item_id=7665153) +_ +_ +_ +version +help +$USER +dev_null; touch _tmp_blns.fail ; echo +`touch _tmp_blns.fail` +$(touch _tmp_blns.fail) +@{[system _touch _tmp_blns.fail_]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby_Rails applications +_ +eval(_puts 'hello world'_) +System(_ls -al __) +`ls -al _` +Kernel.exec(_ls -al __) +Kernel.exit(1) +%x('ls -al _') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +xml version=_1.0_ encoding=_ISO-8859-1____!DOCTYPE foo [ _!ELEMENT foo ANY __!ENTITY xxe SYSTEM _file____etc_passwd_ _]__foo_&xxe;__foo +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%.s +%@ +%n +File +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +.etc_passwd%00 +.etc_hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch _tmp_blns.shellshock1.fail +() { _; } __[$($())] { touch _tmp_blns.shellshock2.fail; } +%s(un='%s') = %u ++++ATH0 +_ +# MSDOS_Windows Special Filenames +# +# Strings which are reserved characters in MSDOS_Windows +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A +ZZ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https___en.wikipedia.org_wiki_Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http___www.cum.qc.ca +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I.Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat_type on this file +_ +Roses are _[0;31mred_[0m, violets are _[0;34mblue.Hope you enjoy terminal hue +But now..._[20Cfor my greatest trick.[8m +The quic______k brown fo___________x.[Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise _MemoryError_ exception +# second, obviously, prints contents of _etc_passwd +_ +{% print 'x' _ 64 _ 1024__3 %} +{{ __.__class__.__mro__[2].__subclasses__()[40](__etc_passwd_).read() }} diff --git a/tests/blns.short-sans-extension_cleverness.capacity b/tests/blns.short-sans-extension_cleverness.capacity new file mode 100644 index 0000000..2d0e046 --- /dev/null +++ b/tests/blns.short-sans-extension_cleverness.capacity @@ -0,0 +1,742 @@ +11 +2 +11 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +11 +5 +11 +2 +3 +1 +11 +2 +11 +1 +2 +2 +5 +6 +4 +4 +5 +6 +3 +6 +7 +5 +5 +6 +7 +4 +4 +11 +11 +3 +5 +3 +5 +5 +5 +2 +6 +5 +5 +2 +6 +6 +8 +8 +8 +8 +4 +2 +3 +3 +11 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +11 +11 +11 +9 +9 +9 +11 +11 +11 +9 +9 +9 +11 +11 +11 +6 +3 +3 +11 +1 +11 +2 +11 +11 +1 +11 +11 +11 +1 +11 +11 +11 +11 +11 +11 +11 +1 +11 +11 +11 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +11 +11 +11 +1 +11 +11 +4 +4 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +10 +10 +11 +11 +1 +11 +2 +11 +1 +2 +2 +3 +3 +4 +9 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +10 +11 +11 +11 +11 +11 +1 +11 +1 +11 +1 +11 +2 +11 +2 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +1 +11 +2 +11 +11 +1 +3 +3 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +8 +2 +11 +1 +5 +9 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +11 +1 +11 +11 +11 +1 +11 +2 +11 +1 +10 +7 +1 +11 +2 +11 +1 +11 +11 +11 +4 +4 +11 +11 +1 +11 +2 +11 +1 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +9 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +2 +2 +2 +1 +11 +2 +11 +1 +2 +3 +10 +7 +6 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +1 +11 +2 +11 +1 +6 +11 +3 +11 +4 +6 +3 +3 +9 +1 +11 +2 +11 +1 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +8 +1 +11 +2 +11 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +11 +2 +11 +1 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +9 +6 +11 +11 +8 +10 +11 +9 +1 +11 +2 +11 +1 +11 +1 +11 +2 +11 +1 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +1 +11 +2 +11 +1 +9 +1 +11 +2 +11 +11 +1 +11 +11 diff --git a/tests/blns.short-sans-extension_cleverness.sanitised b/tests/blns.short-sans-extension_cleverness.sanitised new file mode 100644 index 0000000..9779566 --- /dev/null +++ b/tests/blns.short-sans-extension_cleverness.sanitised @@ -0,0 +1,742 @@ +# Reserved +# +# Strings +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProp +then +constructo +_ +_ +_ +# Numeric +# +# Strings +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1_0 +0_0 +2147483648 +9223372036 +0 +0.0 ++0 ++0.0 +0.00 +0..0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +1 +_ +_ +_ +9999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffff +0xabad1dea +1234567890 +1,000.00 +1 000.00 +1'000.00 +1,000,000 +1 000 000 +1'000'000 +1.000,00 +1 000,00 +1'000,00 +1.000.000 +1 000 000 +1'000'000 +01000 +08 +09 +2.22507385 +_ +# Special +# +# ASCII pu +# contexts +_ +'[]_-= +{}__+ +!@#$%^&_() +_ +# Non-whit +# and U+00 +# Often fo +# or reuse +# appear i +# The next +_ +_ +# Non-whit +# Commonly +# The next +_ +_ +# Whitespa +# version +# and U+20 +# treated +# This fil +# U+0000 +# The next +# The next +​ +_ +# Unicode +# general +# The next +­؀؁؂؃ +_ +# _Byte or +# The next + +￾ +_ +# Unicode +# +# Strings +_ +Ω≈ç√ +åß∂ƒ +œ∑´® +¡™£¢ +¸˛Ç◊ +ÅÍÎÏ˝ +Œ„´‰ +`⁄€‹ +⅛⅜⅝ +ЁЂЃЄЅ +٠١٢٣٤ +_ +# Unicode +# +# Strings +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵ +ด้้ +_ +# Quotatio +# +# Strings +_ +' +_ +'' +_ +'_' +''''_' +'_'_'''' +foo val= +foo val= +foo val= +foo val=`b +_ +# Two-Byte +# +# Strings +_ +田中さ +パーテ +和製漢 +部落格 +사회과 +찦차를 +社會科 +울란바 +𠜎𠜱 +_ +# Strings +_ +𐐜 𐐔 +_ +# Special +# +# A super +# +# 表 CJK +# ポ KATA +# あ HIRA +# A LATIN +# 鷗 CJK +# Œ LATIN +# é LATIN +# Ｂ FULL +# 逍 CJK +# Ü LATIN +# ß LATIN +# ª FEMIN +# ą LATIN +# ñ LATIN +# 丂 CJK +# 㐀 CJK +# 𠀀 CJK +_ +表ポあA +_ +# Changing +# +# Characte +# Credit +_ +Ⱥ +Ⱦ +_ +# Japanese +# +# Strings +_ +ヽ༼ຈ +(｡◕ +｀ｨ(´ +ﾛ(,_,_) +・(￣∀ +ﾟ･✿ +。・ +(╯°□ +(ﾉಥ益 +┬─┬ +( ͡° ͜ +¯__(ツ) +_ +# Emoji +# +# Strings +_ +😍 +👩🏽 +👨‍ +👾 🙇 +🐵 🙈 +❤️ +✋🏿 +👨‍ +🚾 🆒 +0️⃣ 1 +_ +# Regional +# +# Regional +# fonts, a +_ +🇺🇸 +🇺🇸 +🇺🇸 +_ +# Unicode +# +# Strings +_ +１２３ +١٢٣ +_ +# Right-To +# +# Strings +_ +ثم نف +בְּרֵ +הָיְת +﷽ +ﷺ +مُنَا +الكل +_ +# Ogham Te +# +# The only +_ +᚛ᚄᚓ +᚛ ᚜ +_ +# Trick Un +# +# Strings +_ +test +test +test +test⁠tes +test +_ +# Zalgo Te +# +# Strings +_ +Ṱ̺̺̕o +̡͓̞ͅI +̗̺͖̹̯ +̦H̬̤̗ +Z̮̞̠͙ +_ +# Unicode +# +# Strings +_ +˙ɐnbᴉl +00˙Ɩ$ +_ +# Unicode +# +# Strings +_ +Ｔｈｅ +𝐓𝐡 +𝕿𝖍 +𝑻𝒉 +𝓣𝓱 +𝕋𝕙 +𝚃𝚑 +⒯⒣⒠ +_ +# Script I +# +# Strings +_ +script_ale +<script +img src=x +svg__scrip +script_ale +'__script +script_ale +script__sc +script +onfocus=Ja +onfocus=Ja +' onfocus= +＜script +sc_script +script_ale +alert(15) +';alert(16 +JavaSCript +alert(18) +src=JaVaSC +script_ale +'__script +script_ale +autofocus +' autofocu +script_x20 +script_x3E +script_x0D +script_x09 +script_x0C +script_x2F +script_x0A +'`____x3Cs +'`____x00s +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=_ja +a href=_ja +a href=_ja +a href=_ja +a href=_ja +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +img _x00sr +img _x47sr +img _x11sr +img _x12sr +img_x47src +img_x10src +img_x13src +img_x32src +img_x47src +img_x11src +img _x47sr +img _x34sr +img _x39sr +img _x00sr +img src_x0 +img src_x1 +img src_x1 +img src_x3 +img src_x1 +img src_x1 +img src_x0 +img src_x4 +img src=x +img src=x +img src=x +img src=x +img src=x +img[a][b][ +img src=x +img src=x +img src=x +img src=x +img src=x +img src=x +a href=jav +img src=_x +img src on +title onpr +a href=htt +!--[if]__s +!--[if_img +script src +script src +IMG _____S +IMG SRC=ja +IMG SRC=# +IMG SRC= o +IMG onmous +IMG SRC=&# +IMG SRC=&# +IMG SRC=&# +IMG SRC=_j +IMG SRC=_j +IMG SRC=_j +IMG SRC=_j +perl -e 'p +IMG SRC= +SCRIPT_XSS +BODY onloa +SCRIPT_SRC +SCRIPT_ale +SCRIPT SRC +SCRIPT SRC +IMG SRC=_j +iframe src +alert('223 +u oncopy=a +i onwheel= +plaintext +http___a_% +textarea +_ +# SQL Inje +# +# Strings +_ +1;DROP TAB +1'; DROP T +' OR 1=1 +' OR '1'=' +'; EXEC sp +_ +% +_ +_ +# Server C +# +# Strings +_ +_ +_ +version +help +$USER +dev_null +`touch _tm +$(touch _t +@{[system +_ +# Command +# +# Strings +_ +eval(_puts +System(_ls +`ls -al _` +Kernel.exe +Kernel.exi +%x('ls -al +_ +# XXE Inje +# +# String w +_ +xml versio +_ +# Unwanted +# +# Strings +_ +$HOME +$ENV{'HOME +%d +%s%s%s%s%s +{0} +%_._s +%@ +%n +File +_ +# File Inc +# +# Strings +_ +etc_passwd +etc_hosts +_ +# Known CV +# +# Strings +_ +() { 0; } +() { _; } +%s(un='%s' ++++ATH0 +_ +# MSDOS_Wi +# +# Strings +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A +ZZ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +# IRC spec +# +# Strings +_ +DCC SEND S +_ +# Scunthor +# +# Innocuou +_ +Scunthorpe +Penistone +Lightwater +Jimmy Clit +Horniman M +shitake mu +RomansInSu +http___www +Craig Cock +Linda Call +Dr. Herman +magna cum +Super Bowl +medieval e +evaluate +mocha +expression +Arsenal ca +classic +Tyson Gay +Dick Van D +basement +_ +# Human in +# +# Strings +_ +If you're +_ +# Terminal +# +# Strings +_ +Roses are +But now +The quic +_ +# iOS Vuln +# +# Strings +_ +Powerلُ +🏳0🌈 +జ్ఞ +_ +# Persian +# +# This is +_ +گچپژ +_ +# jinja2 i +# +# first on +# second +_ +{% print ' +{{ __.__cl diff --git a/tests/blns.short.capacity b/tests/blns.short.capacity new file mode 100644 index 0000000..97f111a --- /dev/null +++ b/tests/blns.short.capacity @@ -0,0 +1,742 @@ +11 +2 +11 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +11 +5 +11 +2 +3 +1 +11 +2 +11 +1 +2 +2 +5 +5 +4 +4 +5 +6 +3 +5 +7 +5 +5 +6 +7 +4 +4 +11 +11 +3 +5 +3 +5 +5 +5 +1 +6 +5 +5 +2 +6 +5 +7 +7 +8 +8 +4 +2 +2 +3 +11 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +11 +11 +11 +8 +8 +8 +12 +12 +12 +8 +9 +9 +10 +11 +11 +6 +3 +3 +10 +1 +11 +2 +15 +11 +1 +10 +11 +11 +1 +11 +11 +15 +11 +11 +11 +11 +1 +11 +11 +11 +11 +1 +11 +15 +11 +11 +11 +11 +11 +11 +11 +1 +11 +11 +11 +11 +1 +11 +11 +4 +4 +1 +11 +2 +15 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +10 +10 +11 +11 +1 +11 +2 +11 +1 +2 +2 +3 +3 +4 +9 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +10 +11 +11 +11 +11 +11 +1 +11 +1 +11 +1 +11 +2 +11 +2 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +1 +11 +2 +11 +15 +1 +3 +3 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +8 +2 +11 +1 +5 +9 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +11 +1 +11 +11 +11 +1 +11 +2 +11 +1 +10 +7 +1 +11 +2 +15 +1 +11 +11 +11 +4 +4 +11 +11 +1 +11 +2 +11 +1 +11 +11 +1 +11 +2 +15 +1 +11 +11 +11 +11 +11 +1 +11 +2 +15 +1 +15 +15 +13 +13 +11 +1 +11 +2 +15 +1 +11 +9 +1 +11 +2 +15 +1 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +15 +11 +11 +11 +11 +11 +15 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +15 +15 +15 +11 +15 +13 +11 +15 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +2 +2 +2 +1 +11 +2 +15 +1 +2 +3 +10 +7 +6 +15 +15 +15 +15 +1 +11 +2 +11 +1 +11 +11 +11 +11 +11 +11 +1 +11 +2 +11 +1 +15 +1 +11 +2 +11 +1 +6 +11 +3 +11 +4 +5 +3 +3 +9 +1 +11 +2 +11 +1 +15 +15 +1 +11 +2 +11 +1 +15 +15 +11 +8 +1 +11 +2 +11 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +11 +2 +11 +1 +11 +1 +11 +2 +15 +1 +11 +11 +11 +11 +11 +11 +13 +14 +11 +11 +15 +11 +11 +11 +9 +6 +11 +11 +8 +10 +11 +9 +1 +11 +2 +11 +1 +11 +1 +11 +2 +11 +1 +15 +15 +15 +1 +11 +2 +11 +1 +11 +11 +11 +1 +11 +2 +11 +1 +9 +1 +11 +2 +11 +11 +1 +11 +15 diff --git a/tests/blns.short.sanitised b/tests/blns.short.sanitised new file mode 100644 index 0000000..c28efa5 --- /dev/null +++ b/tests/blns.short.sanitised @@ -0,0 +1,746 @@ +# Reserved +# +# Strings +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProp +then +constructo +_ +_ +_ +# Numeric +# +# Strings +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1_0 +0_0 +2147483648 +9223372036 +0 +0.0 ++0 ++0.0 +0.00 +0.0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +1 +_ +_ +_ +9999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffff +0xabad1dea +1234567890 +1,000.00 +1 000.00 +1'000.00 +1,000,0.00 +1 000 0.00 +1'000'0.00 +1.000 +1 000,00 +1'000,00 +1.000.000 +1 000 000 +1'000'000 +01000 +08 +09 +2.2250 +_ +# Special +# +# ASCII pu +# context. +_ +.'[] +{}__+ +!@#$%^&_() +_ +# Non-whit +# and U+00 +# Often fo +# or reuse +# appear. +# The nex. +_ +_ +# Non-whi. +# Commonl. +# The nex. +_ +_ +# Whitespa +# version +# and U+20 +# treated. +# This fil +# U+0000. +# The nex. +# The nex. +​ +_ +# Unicode +# general. +# The nex. +­؀؁؂؃ +_ +# _Byte o. +# The nex. + +￾ +_ +# Unicode +# +# Strings +_ +Ω≈ç√ +åß∂ƒ +œ∑´® +¡™£¢ +¸˛Ç◊ +ÅÍÎÏ˝ +Œ„´‰ +`⁄€‹ +⅛⅜⅝ +ЁЂЃЄЅ +٠١٢٣٤ +_ +# Unicode +# +# Strings +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵ +ด้้ +_ +# Quotatio +# +# Strings +_ +' +_ +'' +_ +'_' +''''_' +'_'_'''' +foo val= +foo val= +foo val= +foo val=`b +_ +# Two-Byte +# +# Strings +_ +田中さ +パーテ +和製漢 +部落格 +사회과 +찦차를 +社會科 +울란바 +𠜎𠜱 +_ +# Strings +_ +𐐜 𐐔 +_ +# Special +# +# A super. +# +# 表 CJK +# ポ KATA +# あ HIRA +# A LATIN +# 鷗 CJK +# Œ LATIN +# é LATIN +# Ｂ FULL +# 逍 CJK +# Ü LATIN +# ß LATIN +# ª FEMIN +# ą LATIN +# ñ LATIN +# 丂 CJK +# 㐀 CJK +# 𠀀 CJK +_ +表ポあA +_ +# Changing +# +# Characte +# Credit.c +_ +Ⱥ +Ⱦ +_ +# Japanese +# +# Strings +_ +ヽ༼ຈ +(｡◕ +｀ｨ(´ +ﾛ(,_,_) +・(￣∀ +ﾟ･✿ +。・ +(╯°□ +(ﾉಥ益 +┬─┬ +( ͡° ͜ +¯__(ツ) +_ +# Emoji +# +# Strings +_ +😍 +👩🏽 +👨‍ +👾 🙇 +🐵 🙈 +❤️ +✋🏿 +👨‍ +🚾 🆒 +0️⃣ 1 +_ +# Regional +# +# Regional +# fonts, a +_ +🇺🇸 +🇺🇸 +🇺🇸 +_ +# Unicode +# +# Strings +_ +１２３ +١٢٣ +_ +# Right-To +# +# Strings +_ +ثم نف. +בְּרֵ +הָיְת +﷽ +ﷺ +مُنَا +الكل +_ +# Ogham Te +# +# The onl. +_ +᚛ᚄᚓ +᚛ ᚜ +_ +# Trick Un +# +# Str.pdf) +_ +test +test +test +test⁠tes +test +_ +# Zalgo Te +# +# Str.net) +_ +Ṱ̺̺̕o +̡͓̞ͅI +̗̺͖.̟ +̦H̬̤.͕ +Z̮̞̠͙ +_ +# Unicode +# +# Str.com) +_ +˙ɐnbᴉl +00˙Ɩ$ +_ +# Unicode +# +# Strings +_ +Ｔｈｅ +𝐓𝐡 +𝕿𝖍 +𝑻𝒉 +𝓣𝓱 +𝕋𝕙 +𝚃𝚑 +⒯⒣⒠ +_ +# Script I +# +# Strings +_ +script_ale +<script +img src=x +svg__scrip +script_ale +'__script +script_ale +script__sc +script +onfocus=Ja +onfocus=Ja +' onfocus= +＜script +sc_script +script_ale +alert(15) +';alert(16 +JavaSCript +alert(18) +src=JaVaSC +script_ale +'__script +script_ale +autofocus +' autofocu +script_x20 +script_x3E +script_x0D +script_x09 +script_x0C +script_x2F +script_x0A +'`____x3Cs +'`____x00s +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +ABC_div st +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=__x +a href=_ja +a href=_ja +a href=_ja +a href=_ja +a href=_ja +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`_'__img s +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +`'__script +img _x00sr +img _x47sr +img _x11sr +img _x12sr +img_x47src +img_x10src +img_x13src +img_x32src +img_x47src +img_x11src +img _x47sr +img _x34sr +img _x39sr +img _x00sr +img src_x0 +img src_x1 +img src_x1 +img src_x3 +img src_x1 +img src_x1 +img src_x0 +img src_x4 +img src=x +img src=x +img src=x +img src=x +img src=x +img[a][b][ +img src=x +img src=x +img src=x +img src=x +img src=x +img src=x +a href=jav +img src=_x +img src on +title onpr +a href=htt +!--[if]__s +!--[if_img +script src +script src +IMG _____S +IMG SRC=ja +IMG SRC=# +IMG SRC= o +IMG onmous +IMG SRC=&# +IMG SRC=&# +IMG SRC=&# +IMG SRC=_j +IMG SRC=_j +IMG SRC=_j +IMG SRC=_j +perl -e 'p +IMG SRC= +SCRIPT_XSS +BODY onloa +SCRIPT_SRC +SCRIPT_ale +SCRIPT SRC +SCRIPT S.j +IMG SRC=_j +iframe src +alert('223 +u oncopy=a +i onwheel= +plaintext +http___a_% +textarea +_ +# SQL Inje +# +# Strings +_ +1;DROP TAB +1'; DROP T +' OR 1=1 +' OR '1'=' +'; EXEC sp +_ +% +_ +_ +# Server C +# +# Strings +_ +_ +_ +version +help +$USER +dev_null.f +`touch _tm +$(touch _t +@{[system +_ +# Command +# +# Strings +_ +eval(_puts +System(_ls +`ls -al _` +Kernel.exe +Kernel.exi +%x('ls -al +_ +# XXE Inje +# +# String w +_ +xml versio +_ +# Unwanted +# +# Strings. +_ +$HOME +$ENV{'HOME +%d +%s%s%s%s%s +{0} +%.s +%@ +%n +File +_ +# File Inc +# +# Strings +_ +.etc +.etc +_ +# Known CV +# +# Strings +_ +() { 0; } +() { _; } +%s(un='%s' ++++ATH0 +_ +# MSDOS_Wi +# +# Strings +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A +ZZ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +# IRC spec +# +# Strings +_ +DCC SEND S +_ +# Scunthor +# +# Innocuou +_ +Scunthorpe +Penistone +Lightwater +Jimmy Clit +Horniman M +shitake mu +RomansI.uk +http.ca +Craig Cock +Linda Call +Dr. Herman +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +Dr.Herm +magna cum +Super Bowl +medieval e +evaluate +mocha +expression +Arsenal ca +classic +Tyson Gay +Dick Van D +basement +_ +# Human in +# +# Strings +_ +If you're. +_ +# Terminal +# +# Strings +_ +Roses are +But no.[8m +The quic.[ +_ +# iOS Vuln +# +# Strings +_ +Powerلُ +🏳0🌈 +జ్ఞ +_ +# Persian +# +# This is +_ +گچپژ +_ +# jinja2 i +# +# first on +# second +_ +{% print ' +{{ __.__cl +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +{{.cl diff --git a/tests/blns.silly-replace_with.capacity b/tests/blns.silly-replace_with.capacity new file mode 100644 index 0000000..a64f1d6 --- /dev/null +++ b/tests/blns.silly-replace_with.capacity @@ -0,0 +1,742 @@ +19 +2 +46 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +15 +5 +12 +2 +3 +1 +18 +2 +46 +1 +2 +2 +5 +5 +4 +4 +5 +6 +3 +5 +7 +5 +5 +6 +7 +4 +4 +15 +24 +3 +5 +3 +5 +5 +5 +1 +6 +5 +5 +2 +6 +5 +7 +7 +8 +8 +4 +2 +2 +3 +97 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +19 +11 +40 +8 +8 +8 +12 +12 +12 +8 +9 +9 +12 +13 +13 +6 +3 +3 +23 +1 +21 +2 +76 +78 +1 +10 +11 +13 +1 +76 +19 +74 +73 +18 +67 +28 +1 +78 +59 +78 +63 +1 +76 +75 +77 +41 +60 +42 +67 +73 +63 +1 +68 +41 +67 +256 +1 +62 +72 +4 +4 +1 +18 +2 +66 +1 +26 +26 +29 +30 +22 +27 +30 +35 +13 +159 +21 +1 +40 +2 +84 +1 +10 +10 +19 +256 +1 +18 +2 +77 +1 +2 +2 +3 +3 +4 +9 +11 +22 +22 +22 +18 +1 +22 +2 +99 +1 +34 +34 +13 +10 +32 +57 +31 +16 +29 +1 +131 +1 +228 +1 +35 +2 +174 +2 +47 +43 +42 +46 +47 +49 +56 +58 +47 +60 +51 +51 +57 +56 +47 +57 +59 +1 +44 +1 +34 +2 +69 +60 +1 +3 +3 +1 +21 +2 +82 +1 +46 +20 +19 +12 +21 +45 +52 +32 +33 +26 +18 +14 +1 +8 +2 +98 +1 +5 +9 +74 +40 +20 +77 +53 +145 +40 +85 +1 +35 +2 +71 +54 +1 +42 +37 +25 +1 +18 +2 +102 +1 +10 +7 +1 +24 +2 +90 +1 +256 +112 +48 +4 +4 +225 +36 +1 +13 +2 +95 +1 +46 +58 +1 +16 +2 +136 +1 +14 +11 +11 +15 +11 +1 +13 +2 +126 +1 +264 +260 +258 +258 +52 +1 +21 +2 +95 +1 +193 +9 +1 +15 +2 +70 +1 +114 +149 +149 +149 +149 +149 +149 +114 +1 +19 +2 +88 +1 +26 +49 +31 +37 +28 +28 +27 +35 +43 +40 +41 +41 +35 +44 +30 +16 +16 +21 +12 +26 +33 +33 +31 +42 +42 +65 +65 +65 +65 +65 +65 +65 +46 +46 +57 +58 +58 +58 +58 +58 +58 +66 +66 +62 +66 +66 +58 +58 +66 +66 +58 +66 +58 +66 +66 +66 +66 +58 +66 +66 +66 +73 +73 +77 +73 +81 +73 +73 +81 +81 +81 +73 +73 +73 +73 +73 +73 +81 +73 +73 +73 +81 +73 +73 +81 +73 +81 +73 +81 +73 +81 +81 +73 +73 +73 +81 +81 +81 +73 +73 +74 +74 +74 +82 +74 +74 +74 +74 +82 +82 +74 +82 +74 +74 +74 +74 +74 +74 +54 +54 +54 +54 +54 +54 +54 +54 +54 +54 +47 +47 +55 +55 +55 +55 +47 +55 +55 +55 +47 +55 +55 +55 +47 +47 +59 +44 +47 +55 +47 +55 +55 +55 +51 +55 +55 +55 +55 +55 +47 +55 +55 +55 +47 +47 +51 +37 +48 +48 +48 +47 +47 +47 +47 +47 +47 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +47 +47 +47 +47 +47 +49 +48 +48 +48 +48 +48 +48 +81 +58 +54 +69 +94 +51 +56 +38 +38 +41 +57 +39 +38 +33 +137 +218 +126 +41 +43 +43 +43 +63 +46 +54 +51 +50 +35 +44 +30 +35 +48 +19 +31 +43 +12 +17 +39 +1 +16 +2 +70 +1 +19 +25 +14 +12 +45 +2 +2 +2 +1 +24 +2 +125 +1 +2 +3 +10 +7 +6 +38 +22 +23 +34 +1 +27 +2 +72 +1 +27 +19 +11 +23 +14 +15 +1 +27 +2 +84 +1 +138 +1 +25 +2 +256 +1 +6 +13 +3 +11 +4 +5 +3 +3 +9 +1 +17 +2 +90 +1 +46 +42 +1 +33 +2 +46 +1 +44 +58 +21 +8 +1 +34 +2 +57 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +25 +2 +80 +1 +30 +1 +21 +2 +112 +1 +28 +27 +24 +16 +16 +18 +20 +21 +36 +15 +22 +16 +15 +30 +9 +6 +11 +14 +8 +10 +14 +9 +1 +18 +2 +57 +1 +211 +1 +24 +2 +63 +1 +78 +43 +48 +1 +22 +2 +60 +1 +62 +13 +16 +1 +29 +2 +88 +1 +9 +1 +19 +2 +57 +52 +1 +31 +72 diff --git a/tests/blns.silly-replace_with.sanitised b/tests/blns.silly-replace_with.sanitised new file mode 100644 index 0000000..ce7634c --- /dev/null +++ b/tests/blns.silly-replace_with.sanitised @@ -0,0 +1,1216 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +] +]] +_ +# Numeric Strings +# +# Strings which can be interpreted as numeric +_ +0 +1 +1.00 +$1.00 +102 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +102 +1E2 +1E02 +1E+02 +100 +000 +21474836480-1 +92233720368547758080-1 +0 +0.0 ++0 ++0.0 +0.00 +0.0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.000 +1.000.0 +0.000.0 +1,000,0 +0,000,0 +1 +_ +_ +_ +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +Infinity +INF +1#INF +1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +# Special Characters +# +# ASCII punctuation.All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. +_ +.0;'[]]-= +=?@;#{}}_+ +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=@@;#{}}_+ +!@#$%^&+()`~ +_ +# Non-whitespace C0 controls; U+0001 through U+0008, U+000E through U+001F +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g.XML) +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. +  € +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +   +_ +# Non-whitespace C1 controls; U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +‚ƒ„…‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ  +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +‚ƒ„… ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ  +_ +# Whitespace; all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL) +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for #trailing whitespace# in some viewers. +​ +_ +# Unicode additional control characters; all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‫‬‭‮ ⁠⁡⁢⁣⁤⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‬‭‮  ⁠⁡⁢⁣⁤⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵 +_ +# #Byte order marks#, U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ +_ +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g.smart quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +# Unicode Subscript0Superscript0Accents +# +# Strings which contain unicode subscripts0superscripts; can cause rendering issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors +_ +' +# +'' +## +'#' +#''''#'# +#'#'#''''# +=foo val=“bar” 0? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=foo val=“bar” 0@ +=foo val=“bar” 0? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=foo val=“bar” 0@ +=foo val=”bar“ 0? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=foo val=”bar“ 0@ +=foo val=`bar' 0? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=foo val=`bar' 0@ +_ +# Two-Byte Characters +# +# Strings which contain two-byte characters; can cause rendering issues or character-length issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +# Strings which contain two-byte letters; can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character +_ +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓0𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team; can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit; https;00twitter.com0jifa0status0625776454479970304 +_ +Ⱥ +Ⱦ +_ +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web +_ +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +ﾛ(,_,+) +・(￣∀￣)・;+ +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +。・;+;・゜’( ☻ ω ☻ )。・;+;・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯]_(ツ)_0¯ +_ +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always +_ +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 +_ +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors +_ +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric +_ +１２３ +١٢٣ +_ +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g.Arabic, Hebrew) +_ +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر. +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) +_ +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. +_ +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛ ᚜ +_ +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http;00www.unicode.org0charts0PDF0U2000.pdf) +_ +‫‫test‫ +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +‬‬test‬ +‬test‬ +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +‭test‭ +test +test⁠test‬ +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +test⁠test‭ +⁧test⁨ +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +⁨test⁩ +_ +# Zalgo Text +# +# Strings which contain #corrupted# text. The corruption will not appear in non-HTML text, however. (via http;00www.eeemo.net) +_ +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +# Unicode Upsidedown +# +# Strings which contain unicode with an #upsidedown# effect (via http;00www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$ +_ +# Unicode font +# +# Strings which contain bold0italic0etc.versions of normal characters +_ +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ +_ +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS +_ +=script?alert(0)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script@alert(0)=0script@ +<script>alert('1');<0script> +=img src=x onerror=alert(2) 0? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x onerror=alert(2) 0@ +=svg?=script?123=1?alert(3)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=svg@=script@123=1@alert(3)=0script@ +#?=script?alert(4)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#@=script@alert(4)=0script@ +'?=script?alert(5)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +'@=script@alert(5)=0script@ +?=script?alert(6)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +@=script@alert(6)=0script@ +=0script?=script?alert(7)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=0script@=script@alert(7)=0script@ += 0 script ?= script ?alert(8)= 0 script ? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ += 0 script @= script @alert(8)= 0 script @ +onfocus=JaVaSCript;alert(9) autofocus +# onfocus=JaVaSCript;alert(10) autofocus +' onfocus=JaVaSCript;alert(11) autofocus +＜script＞alert(12)＜0script＞ +=sc=script?ript?alert(13)=0sc=0script?ript? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=sc=script@ript@alert(13)=0sc=0script@ript@ +?=script?alert(14)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +@=script@alert(14)=0script@ +#;alert(15);t=# +';alert(16);t=' +JavaSCript;alert(17) +alert(18) +src=JaVaSCript;prompt(19) +#?=script?alert(20);=0script x=# +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#@=script@alert(20);=0script x=# +'?=script?alert(21);=0script x=' +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +'@=script@alert(21);=0script x=' +?=script?alert(22);=0script x= +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +@=script@alert(22);=0script x= +# autofocus onkeyup=#javascript;alert(23) +' autofocus onkeyup='javascript;alert(24) +=script]x20type=#text0javascript#?javascript;alert(25);=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script]x20type=#text0javascript#@javascript;alert(25);=0script@ +=script]x3Etype=#text0javascript#?javascript;alert(26);=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script]x3Etype=#text0javascript#@javascript;alert(26);=0script@ +=script]x0Dtype=#text0javascript#?javascript;alert(27);=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script]x0Dtype=#text0javascript#@javascript;alert(27);=0script@ +=script]x09type=#text0javascript#?javascript;alert(28);=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script]x09type=#text0javascript#@javascript;alert(28);=0script@ +=script]x0Ctype=#text0javascript#?javascript;alert(29);=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script]x0Ctype=#text0javascript#@javascript;alert(29);=0script@ +=script]x2Ftype=#text0javascript#?javascript;alert(30);=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script]x2Ftype=#text0javascript#@javascript;alert(30);=0script@ +=script]x0Atype=#text0javascript#?javascript;alert(31);=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script]x0Atype=#text0javascript#@javascript;alert(31);=0script@ +'`#?=]x3Cscript?javascript;alert(32)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +'`#@=]x3Cscript@javascript;alert(32)=0script@ +'`#?=]x00script?javascript;alert(33)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +'`#@=]x00script@javascript;alert(33)=0script@ +ABC=div style=#x]x3Aexpression(javascript;alert(34)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x]x3Aexpression(javascript;alert(34)#@DEF +ABC=div style=#x;expression]x5C(javascript;alert(35)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;expression]x5C(javascript;alert(35)#@DEF +ABC=div style=#x;expression]x00(javascript;alert(36)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;expression]x00(javascript;alert(36)#@DEF +ABC=div style=#x;exp]x00ression(javascript;alert(37)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;exp]x00ression(javascript;alert(37)#@DEF +ABC=div style=#x;exp]x5Cression(javascript;alert(38)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;exp]x5Cression(javascript;alert(38)#@DEF +ABC=div style=#x;]x0Aexpression(javascript;alert(39)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]x0Aexpression(javascript;alert(39)#@DEF +ABC=div style=#x;]x09expression(javascript;alert(40)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]x09expression(javascript;alert(40)#@DEF +ABC=div style=#x;]xE3]x80]x80expression(javascript;alert(41)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE3]x80]x80expression(javascript;alert(41)#@DEF +ABC=div style=#x;]xE2]x80]x84expression(javascript;alert(42)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x84expression(javascript;alert(42)#@DEF +ABC=div style=#x;]xC2]xA0expression(javascript;alert(43)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xC2]xA0expression(javascript;alert(43)#@DEF +ABC=div style=#x;]xE2]x80]x80expression(javascript;alert(44)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x80expression(javascript;alert(44)#@DEF +ABC=div style=#x;]xE2]x80]x8Aexpression(javascript;alert(45)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x8Aexpression(javascript;alert(45)#@DEF +ABC=div style=#x;]x0Dexpression(javascript;alert(46)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]x0Dexpression(javascript;alert(46)#@DEF +ABC=div style=#x;]x0Cexpression(javascript;alert(47)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]x0Cexpression(javascript;alert(47)#@DEF +ABC=div style=#x;]xE2]x80]x87expression(javascript;alert(48)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x87expression(javascript;alert(48)#@DEF +ABC=div style=#x;]xEF]xBB]xBFexpression(javascript;alert(49)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xEF]xBB]xBFexpression(javascript;alert(49)#@DEF +ABC=div style=#x;]x20expression(javascript;alert(50)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]x20expression(javascript;alert(50)#@DEF +ABC=div style=#x;]xE2]x80]x88expression(javascript;alert(51)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x88expression(javascript;alert(51)#@DEF +ABC=div style=#x;]x00expression(javascript;alert(52)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]x00expression(javascript;alert(52)#@DEF +ABC=div style=#x;]xE2]x80]x8Bexpression(javascript;alert(53)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x8Bexpression(javascript;alert(53)#@DEF +ABC=div style=#x;]xE2]x80]x86expression(javascript;alert(54)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x86expression(javascript;alert(54)#@DEF +ABC=div style=#x;]xE2]x80]x85expression(javascript;alert(55)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x85expression(javascript;alert(55)#@DEF +ABC=div style=#x;]xE2]x80]x82expression(javascript;alert(56)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x82expression(javascript;alert(56)#@DEF +ABC=div style=#x;]x0Bexpression(javascript;alert(57)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]x0Bexpression(javascript;alert(57)#@DEF +ABC=div style=#x;]xE2]x80]x81expression(javascript;alert(58)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x81expression(javascript;alert(58)#@DEF +ABC=div style=#x;]xE2]x80]x83expression(javascript;alert(59)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x83expression(javascript;alert(59)#@DEF +ABC=div style=#x;]xE2]x80]x89expression(javascript;alert(60)#?DEF +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +ABC=div style=#x;]xE2]x80]x89expression(javascript;alert(60)#@DEF +=a href=#]x0Bjavascript;javascript;alert(61)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x0Bjavascript;javascript;alert(61)# id=#fuzzelement1#@test=0a@ +=a href=#]x0Fjavascript;javascript;alert(62)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x0Fjavascript;javascript;alert(62)# id=#fuzzelement1#@test=0a@ +=a href=#]xC2]xA0javascript;javascript;alert(63)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xC2]xA0javascript;javascript;alert(63)# id=#fuzzelement1#@test=0a@ +=a href=#]x05javascript;javascript;alert(64)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x05javascript;javascript;alert(64)# id=#fuzzelement1#@test=0a@ +=a href=#]xE1]xA0]x8Ejavascript;javascript;alert(65)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE1]xA0]x8Ejavascript;javascript;alert(65)# id=#fuzzelement1#@test=0a@ +=a href=#]x18javascript;javascript;alert(66)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x18javascript;javascript;alert(66)# id=#fuzzelement1#@test=0a@ +=a href=#]x11javascript;javascript;alert(67)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x11javascript;javascript;alert(67)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x88javascript;javascript;alert(68)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x88javascript;javascript;alert(68)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x89javascript;javascript;alert(69)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x89javascript;javascript;alert(69)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x80javascript;javascript;alert(70)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x80javascript;javascript;alert(70)# id=#fuzzelement1#@test=0a@ +=a href=#]x17javascript;javascript;alert(71)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x17javascript;javascript;alert(71)# id=#fuzzelement1#@test=0a@ +=a href=#]x03javascript;javascript;alert(72)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x03javascript;javascript;alert(72)# id=#fuzzelement1#@test=0a@ +=a href=#]x0Ejavascript;javascript;alert(73)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x0Ejavascript;javascript;alert(73)# id=#fuzzelement1#@test=0a@ +=a href=#]x1Ajavascript;javascript;alert(74)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x1Ajavascript;javascript;alert(74)# id=#fuzzelement1#@test=0a@ +=a href=#]x00javascript;javascript;alert(75)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x00javascript;javascript;alert(75)# id=#fuzzelement1#@test=0a@ +=a href=#]x10javascript;javascript;alert(76)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x10javascript;javascript;alert(76)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x82javascript;javascript;alert(77)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x82javascript;javascript;alert(77)# id=#fuzzelement1#@test=0a@ +=a href=#]x20javascript;javascript;alert(78)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x20javascript;javascript;alert(78)# id=#fuzzelement1#@test=0a@ +=a href=#]x13javascript;javascript;alert(79)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x13javascript;javascript;alert(79)# id=#fuzzelement1#@test=0a@ +=a href=#]x09javascript;javascript;alert(80)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x09javascript;javascript;alert(80)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x8Ajavascript;javascript;alert(81)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x8Ajavascript;javascript;alert(81)# id=#fuzzelement1#@test=0a@ +=a href=#]x14javascript;javascript;alert(82)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x14javascript;javascript;alert(82)# id=#fuzzelement1#@test=0a@ +=a href=#]x19javascript;javascript;alert(83)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x19javascript;javascript;alert(83)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]xAFjavascript;javascript;alert(84)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]xAFjavascript;javascript;alert(84)# id=#fuzzelement1#@test=0a@ +=a href=#]x1Fjavascript;javascript;alert(85)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x1Fjavascript;javascript;alert(85)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x81javascript;javascript;alert(86)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x81javascript;javascript;alert(86)# id=#fuzzelement1#@test=0a@ +=a href=#]x1Djavascript;javascript;alert(87)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x1Djavascript;javascript;alert(87)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x87javascript;javascript;alert(88)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x87javascript;javascript;alert(88)# id=#fuzzelement1#@test=0a@ +=a href=#]x07javascript;javascript;alert(89)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x07javascript;javascript;alert(89)# id=#fuzzelement1#@test=0a@ +=a href=#]xE1]x9A]x80javascript;javascript;alert(90)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE1]x9A]x80javascript;javascript;alert(90)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x83javascript;javascript;alert(91)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x83javascript;javascript;alert(91)# id=#fuzzelement1#@test=0a@ +=a href=#]x04javascript;javascript;alert(92)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x04javascript;javascript;alert(92)# id=#fuzzelement1#@test=0a@ +=a href=#]x01javascript;javascript;alert(93)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x01javascript;javascript;alert(93)# id=#fuzzelement1#@test=0a@ +=a href=#]x08javascript;javascript;alert(94)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x08javascript;javascript;alert(94)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x84javascript;javascript;alert(95)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x84javascript;javascript;alert(95)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x86javascript;javascript;alert(96)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x86javascript;javascript;alert(96)# id=#fuzzelement1#@test=0a@ +=a href=#]xE3]x80]x80javascript;javascript;alert(97)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE3]x80]x80javascript;javascript;alert(97)# id=#fuzzelement1#@test=0a@ +=a href=#]x12javascript;javascript;alert(98)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x12javascript;javascript;alert(98)# id=#fuzzelement1#@test=0a@ +=a href=#]x0Djavascript;javascript;alert(99)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x0Djavascript;javascript;alert(99)# id=#fuzzelement1#@test=0a@ +=a href=#]x0Ajavascript;javascript;alert(100)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x0Ajavascript;javascript;alert(100)# id=#fuzzelement1#@test=0a@ +=a href=#]x0Cjavascript;javascript;alert(101)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x0Cjavascript;javascript;alert(101)# id=#fuzzelement1#@test=0a@ +=a href=#]x15javascript;javascript;alert(102)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x15javascript;javascript;alert(102)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]xA8javascript;javascript;alert(103)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]xA8javascript;javascript;alert(103)# id=#fuzzelement1#@test=0a@ +=a href=#]x16javascript;javascript;alert(104)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x16javascript;javascript;alert(104)# id=#fuzzelement1#@test=0a@ +=a href=#]x02javascript;javascript;alert(105)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x02javascript;javascript;alert(105)# id=#fuzzelement1#@test=0a@ +=a href=#]x1Bjavascript;javascript;alert(106)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x1Bjavascript;javascript;alert(106)# id=#fuzzelement1#@test=0a@ +=a href=#]x06javascript;javascript;alert(107)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x06javascript;javascript;alert(107)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]xA9javascript;javascript;alert(108)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]xA9javascript;javascript;alert(108)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x80]x85javascript;javascript;alert(109)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x80]x85javascript;javascript;alert(109)# id=#fuzzelement1#@test=0a@ +=a href=#]x1Ejavascript;javascript;alert(110)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x1Ejavascript;javascript;alert(110)# id=#fuzzelement1#@test=0a@ +=a href=#]xE2]x81]x9Fjavascript;javascript;alert(111)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]xE2]x81]x9Fjavascript;javascript;alert(111)# id=#fuzzelement1#@test=0a@ +=a href=#]x1Cjavascript;javascript;alert(112)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#]x1Cjavascript;javascript;alert(112)# id=#fuzzelement1#@test=0a@ +=a href=#javascript]x00;javascript;alert(113)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#javascript]x00;javascript;alert(113)# id=#fuzzelement1#@test=0a@ +=a href=#javascript]x3A;javascript;alert(114)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#javascript]x3A;javascript;alert(114)# id=#fuzzelement1#@test=0a@ +=a href=#javascript]x09;javascript;alert(115)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#javascript]x09;javascript;alert(115)# id=#fuzzelement1#@test=0a@ +=a href=#javascript]x0D;javascript;alert(116)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#javascript]x0D;javascript;alert(116)# id=#fuzzelement1#@test=0a@ +=a href=#javascript]x0A;javascript;alert(117)# id=#fuzzelement1#?test=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=#javascript]x0A;javascript;alert(117)# id=#fuzzelement1#@test=0a@ +`#'?=img src=xxx;x ]x0Aonerror=javascript;alert(118)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x0Aonerror=javascript;alert(118)@ +`#'?=img src=xxx;x ]x22onerror=javascript;alert(119)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x22onerror=javascript;alert(119)@ +`#'?=img src=xxx;x ]x0Bonerror=javascript;alert(120)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x0Bonerror=javascript;alert(120)@ +`#'?=img src=xxx;x ]x0Donerror=javascript;alert(121)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x0Donerror=javascript;alert(121)@ +`#'?=img src=xxx;x ]x2Fonerror=javascript;alert(122)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x2Fonerror=javascript;alert(122)@ +`#'?=img src=xxx;x ]x09onerror=javascript;alert(123)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x09onerror=javascript;alert(123)@ +`#'?=img src=xxx;x ]x0Conerror=javascript;alert(124)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x0Conerror=javascript;alert(124)@ +`#'?=img src=xxx;x ]x00onerror=javascript;alert(125)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x00onerror=javascript;alert(125)@ +`#'?=img src=xxx;x ]x27onerror=javascript;alert(126)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x27onerror=javascript;alert(126)@ +`#'?=img src=xxx;x ]x20onerror=javascript;alert(127)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +`#'@=img src=xxx;x ]x20onerror=javascript;alert(127)@ +#`'?=script?]x3Bjavascript;alert(128)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x3Bjavascript;alert(128)=0script@ +#`'?=script?]x0Djavascript;alert(129)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x0Djavascript;alert(129)=0script@ +#`'?=script?]xEF]xBB]xBFjavascript;alert(130)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xEF]xBB]xBFjavascript;alert(130)=0script@ +#`'?=script?]xE2]x80]x81javascript;alert(131)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x81javascript;alert(131)=0script@ +#`'?=script?]xE2]x80]x84javascript;alert(132)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x84javascript;alert(132)=0script@ +#`'?=script?]xE3]x80]x80javascript;alert(133)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE3]x80]x80javascript;alert(133)=0script@ +#`'?=script?]x09javascript;alert(134)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x09javascript;alert(134)=0script@ +#`'?=script?]xE2]x80]x89javascript;alert(135)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x89javascript;alert(135)=0script@ +#`'?=script?]xE2]x80]x85javascript;alert(136)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x85javascript;alert(136)=0script@ +#`'?=script?]xE2]x80]x88javascript;alert(137)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x88javascript;alert(137)=0script@ +#`'?=script?]x00javascript;alert(138)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x00javascript;alert(138)=0script@ +#`'?=script?]xE2]x80]xA8javascript;alert(139)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]xA8javascript;alert(139)=0script@ +#`'?=script?]xE2]x80]x8Ajavascript;alert(140)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x8Ajavascript;alert(140)=0script@ +#`'?=script?]xE1]x9A]x80javascript;alert(141)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE1]x9A]x80javascript;alert(141)=0script@ +#`'?=script?]x0Cjavascript;alert(142)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x0Cjavascript;alert(142)=0script@ +#`'?=script?]x2Bjavascript;alert(143)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x2Bjavascript;alert(143)=0script@ +#`'?=script?]xF0]x90]x96]x9Ajavascript;alert(144)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xF0]x90]x96]x9Ajavascript;alert(144)=0script@ +#`'?=script?-javascript;alert(145)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@-javascript;alert(145)=0script@ +#`'?=script?]x0Ajavascript;alert(146)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x0Ajavascript;alert(146)=0script@ +#`'?=script?]xE2]x80]xAFjavascript;alert(147)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]xAFjavascript;alert(147)=0script@ +#`'?=script?]x7Ejavascript;alert(148)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x7Ejavascript;alert(148)=0script@ +#`'?=script?]xE2]x80]x87javascript;alert(149)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x87javascript;alert(149)=0script@ +#`'?=script?]xE2]x81]x9Fjavascript;alert(150)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x81]x9Fjavascript;alert(150)=0script@ +#`'?=script?]xE2]x80]xA9javascript;alert(151)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]xA9javascript;alert(151)=0script@ +#`'?=script?]xC2]x85javascript;alert(152)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xC2]x85javascript;alert(152)=0script@ +#`'?=script?]xEF]xBF]xAEjavascript;alert(153)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xEF]xBF]xAEjavascript;alert(153)=0script@ +#`'?=script?]xE2]x80]x83javascript;alert(154)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x83javascript;alert(154)=0script@ +#`'?=script?]xE2]x80]x8Bjavascript;alert(155)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x8Bjavascript;alert(155)=0script@ +#`'?=script?]xEF]xBF]xBEjavascript;alert(156)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xEF]xBF]xBEjavascript;alert(156)=0script@ +#`'?=script?]xE2]x80]x80javascript;alert(157)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x80javascript;alert(157)=0script@ +#`'?=script?]x21javascript;alert(158)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x21javascript;alert(158)=0script@ +#`'?=script?]xE2]x80]x82javascript;alert(159)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x82javascript;alert(159)=0script@ +#`'?=script?]xE2]x80]x86javascript;alert(160)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE2]x80]x86javascript;alert(160)=0script@ +#`'?=script?]xE1]xA0]x8Ejavascript;alert(161)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xE1]xA0]x8Ejavascript;alert(161)=0script@ +#`'?=script?]x0Bjavascript;alert(162)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x0Bjavascript;alert(162)=0script@ +#`'?=script?]x20javascript;alert(163)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]x20javascript;alert(163)=0script@ +#`'?=script?]xC2]xA0javascript;alert(164)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +#`'@=script@]xC2]xA0javascript;alert(164)=0script@ +=img ]x00src=x onerror=#alert(165)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x00src=x onerror=#alert(165)#@ +=img ]x47src=x onerror=#javascript;alert(166)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x47src=x onerror=#javascript;alert(166)#@ +=img ]x11src=x onerror=#javascript;alert(167)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x11src=x onerror=#javascript;alert(167)#@ +=img ]x12src=x onerror=#javascript;alert(168)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x12src=x onerror=#javascript;alert(168)#@ +=img]x47src=x onerror=#javascript;alert(169)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img]x47src=x onerror=#javascript;alert(169)#@ +=img]x10src=x onerror=#javascript;alert(170)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img]x10src=x onerror=#javascript;alert(170)#@ +=img]x13src=x onerror=#javascript;alert(171)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img]x13src=x onerror=#javascript;alert(171)#@ +=img]x32src=x onerror=#javascript;alert(172)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img]x32src=x onerror=#javascript;alert(172)#@ +=img]x47src=x onerror=#javascript;alert(173)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img]x47src=x onerror=#javascript;alert(173)#@ +=img]x11src=x onerror=#javascript;alert(174)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img]x11src=x onerror=#javascript;alert(174)#@ +=img ]x47src=x onerror=#javascript;alert(175)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x47src=x onerror=#javascript;alert(175)#@ +=img ]x34src=x onerror=#javascript;alert(176)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x34src=x onerror=#javascript;alert(176)#@ +=img ]x39src=x onerror=#javascript;alert(177)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x39src=x onerror=#javascript;alert(177)#@ +=img ]x00src=x onerror=#javascript;alert(178)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img ]x00src=x onerror=#javascript;alert(178)#@ +=img src]x09=x onerror=#javascript;alert(179)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x09=x onerror=#javascript;alert(179)#@ +=img src]x10=x onerror=#javascript;alert(180)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x10=x onerror=#javascript;alert(180)#@ +=img src]x13=x onerror=#javascript;alert(181)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x13=x onerror=#javascript;alert(181)#@ +=img src]x32=x onerror=#javascript;alert(182)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x32=x onerror=#javascript;alert(182)#@ +=img src]x12=x onerror=#javascript;alert(183)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x12=x onerror=#javascript;alert(183)#@ +=img src]x11=x onerror=#javascript;alert(184)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x11=x onerror=#javascript;alert(184)#@ +=img src]x00=x onerror=#javascript;alert(185)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x00=x onerror=#javascript;alert(185)#@ +=img src]x47=x onerror=#javascript;alert(186)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src]x47=x onerror=#javascript;alert(186)#@ +=img src=x]x09onerror=#javascript;alert(187)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x]x09onerror=#javascript;alert(187)#@ +=img src=x]x10onerror=#javascript;alert(188)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x]x10onerror=#javascript;alert(188)#@ +=img src=x]x11onerror=#javascript;alert(189)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x]x11onerror=#javascript;alert(189)#@ +=img src=x]x12onerror=#javascript;alert(190)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x]x12onerror=#javascript;alert(190)#@ +=img src=x]x13onerror=#javascript;alert(191)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x]x13onerror=#javascript;alert(191)#@ +=img[a][b][c]src[d]=x[e]onerror=[f]#alert(192)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img[a][b][c]src[d]=x[e]onerror=[f]#alert(192)#@ +=img src=x onerror=]x09#javascript;alert(193)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x onerror=]x09#javascript;alert(193)#@ +=img src=x onerror=]x10#javascript;alert(194)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x onerror=]x10#javascript;alert(194)#@ +=img src=x onerror=]x11#javascript;alert(195)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x onerror=]x11#javascript;alert(195)#@ +=img src=x onerror=]x12#javascript;alert(196)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x onerror=]x12#javascript;alert(196)#@ +=img src=x onerror=]x32#javascript;alert(197)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x onerror=]x32#javascript;alert(197)#@ +=img src=x onerror=]x00#javascript;alert(198)#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=x onerror=]x00#javascript;alert(198)#@ +=a href=java script;javascript;alert(199)?XXX=0a? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=java script;javascript;alert(199)@XXX=0a@ +=img src=#x` `=script?javascript;alert(200)=0script?#` `? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src=#x` `=script@javascript;alert(200)=0script@#` `@ +=img src onerror 0# '#= alt=javascript;alert(201)00#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=img src onerror 0# '#= alt=javascript;alert(201)00#@ +=title onpropertychange=javascript;alert(202)?=0title?=title title=? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=title onpropertychange=javascript;alert(202)@=0title@=title title=@ +=a href=http;00foo.bar0#x=`y?=0a?=img alt=#`?=img src=x;x onerror=javascript;alert(203)?=0a?#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=a href=http;00foo.bar0#x=`y@=0a@=img alt=#`@=img src=x;x onerror=javascript;alert(203)@=0a@#@ +=!--[if]?=script?javascript;alert(204)=0script --? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=!--[if]@=script@javascript;alert(204)=0script --@ +=!--[if=img src=x onerror=javascript;alert(205)00]? --? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=!--[if=img src=x onerror=javascript;alert(205)00]@ --@ +=script src=#0]%(jscript)s#?=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script src=#0]%(jscript)s#@=0script@ +=script src=#]]%(jscript)s#?=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=script src=#]]%(jscript)s#@=0script@ +=IMG ###?=SCRIPT?alert(#206#)=0SCRIPT?#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG ###@=SCRIPT@alert(#206#)=0SCRIPT@#@ +=IMG SRC=javascript;alert(String.fromCharCode(50,48,55))? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=javascript;alert(String.fromCharCode(50,48,55))@ +=IMG SRC=# onmouseover=#alert('208')#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=# onmouseover=#alert('208')#@ +=IMG SRC= onmouseover=#alert('209')#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC= onmouseover=#alert('209')#@ +=IMG onmouseover=#alert('210')#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG onmouseover=#alert('210')#@ +=IMG SRC=javascript:alert('211')? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=javascript:alert('211')@ +=IMG SRC=javascript:alert('212')? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=javascript:alert('212')@ +=IMG SRC=javascript:alert('213')? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=javascript:alert('213')@ +=IMG SRC=#jav ascript;alert('214');#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=#jav ascript;alert('214');#@ +=IMG SRC=#jav ascript;alert('215');#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=#jav ascript;alert('215');#@ +=IMG SRC=#jav ascript;alert('216');#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=#jav ascript;alert('216');#@ +=IMG SRC=#jav ascript;alert('217');#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=#jav ascript;alert('217');#@ +perl -e 'print #=IMG SRC=java]0script;alert(]#218]#)?#;' ? out +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +perl -e 'print #=IMG SRC=java]0script;alert(]#218]#)@#;' @ out +=IMG SRC=#  javascript;alert('219');#? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=IMG SRC=#  javascript;alert('219');#@ +=SCRIPT0XSS SRC=#http;00ha.ckers.org0xss.js#?=0SCRIPT? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=SCRIPT0XSS SRC=#http;00ha.ckers.org0xss.js#@=0SCRIPT@ +=BODY onload!#$%&()+~+.@@[0}]]^`=alert(#220#)? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=BODY onload!#$%&()+~+.@@[0}]]^`=alert(#220#)@ +=SCRIPT0SRC=#http;00ha.ckers.org0xss.js#?=0SCRIPT? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=SCRIPT0SRC=#http;00ha.ckers.org0xss.js#@=0SCRIPT@ +==SCRIPT?alert(#221#);00==0SCRIPT? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +==SCRIPT@alert(#221#);00==0SCRIPT@ +=SCRIPT SRC=http;00ha.ckers.org0xss.js@= B ? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=SCRIPT SRC=http;00ha.ckers.org0xss.js@= B @ +=SCRIPT SRC=00ha.ckers.org0.j? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=SCRIPT SRC=00ha.ckers.org0.j@ +=IMG SRC=#javascript;alert('222')# +=iframe src=http;00ha.ckers.org0scriptlet.html = +]#;alert('223');00 +=u oncopy=alert()? Copy me=0u? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=u oncopy=alert()@ Copy me=0u@ +=i onwheel=alert(224)? Scroll over me =0i? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=i onwheel=alert(224)@ Scroll over me =0i@ +=plaintext? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=plaintext@ +http;00a0%%30%30 +=0textarea?=script?alert(225)=0script? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=0textarea@=script@alert(225)=0script@ +_ +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized +_ +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE @' +_ +% +_ +_ +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https;00news.ycombinator.com0item@id=7665153) +_ +_ +_ +version +help +$USER +0dev0null; touch 0tmp0blns.fail ; echo +`touch 0tmp0blns.fail` +$(touch 0tmp0blns.fail) +@{[system #touch 0tmp0blns.fail#]} +_ +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby0Rails applications +_ +eval(#puts 'hello world'#) +System(#ls -al 0#) +`ls -al 0` +Kernel.exec(#ls -al 0#) +Kernel.exit(1) +%x('ls -al 0') +_ +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser +_ +=@xml version=#1.0# encoding=#ISO-8859-1#@?=!DOCTYPE foo [ =!ELEMENT foo ANY ?=!ENTITY xxe SYSTEM #file;000etc0passwd# ?]?=foo?&xxe;=0foo? +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +=@xml version=#1.0# encoding=#ISO-8859-1#@@=!DOCTYPE foo [ =!ELEMENT foo ANY @=!ENTITY xxe SYSTEM #file;000etc0passwd# @]@=foo@&xxe;=0foo@ +_ +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just repr. +_ +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%+.+s +%@ +%n +File;000 +_ +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server +_ +0..0..0..0..0..0..0..0..0..0.0etc0passwd%00 +0..0..0..0..0..0..0..0..0..0.0etc0hosts +_ +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities +_ +() { 0; }; touch 0tmp0blns.shellshock1.fail +() { _; } ?_[$($())] { touch 0tmp0blns.shellshock2.fail; } +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +() { _; } @_[$($())] { touch 0tmp0blns.shellshock2.fail; } +=== %s(un='%s') = %u ++++ATH0 +_ +# MSDOS0Windows Special Filenames +# +# Strings which are reserved characters in MSDOS0Windows +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A +ZZ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out +_ +DCC SEND STARTKEYLOGGER 0 0 0 +_ +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https;00en.wikipedia.org0wiki0Scunthorpe_problem) +_ +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http;00www.cum.qc.ca0 +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I.Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement +_ +# Human injection +# +# Strings which may cause human to reinterpret worldview +_ +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. +_ +# Terminal escape codes +# +# Strings which punish the fools who use cat0type on this file +_ +Roses are [0;31mred[0m, violets are [0;34mblue.Hope you enjoy terminal hue +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +Roses are [0;31mred[0m, violets are [0;34mblue.Hope you enjoy terminal hue +But now...[20Cfor my greatest trick.[8m +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +But now...[20Cfor my greatest trick.[8m +The quic k brown fox.[Beeeep] +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +The quic k brown fo x.[Beeeep] +_ +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS +_ +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) +_ +گچپژ +_ +# jinja2 injection +# +# first one is supposed to raise #MemoryError# exception +# second, obviously, prints contents of 0etc0passwd +_ +{% print 'x' + 64 + 1024++3 %} +{{ ##.__class__.__mro__[2].__subclasses__()[40](#0etc0passwd#).read() }} diff --git a/tests/blns.txt b/tests/blns.txt new file mode 100644 index 0000000..7c27bbd --- /dev/null +++ b/tests/blns.txt @@ -0,0 +1,742 @@ +# Reserved Strings +# +# Strings which may be used elsewhere in code + +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +\ +\\ + +# Numeric Strings +# +# Strings which can be interpreted as numeric + +0 +1 +1.00 +$1.00 +1/2 +1E2 +1E02 +1E+02 +-1 +-1.00 +-$1.00 +-1/2 +-1E2 +-1E02 +-1E+02 +1/0 +0/0 +-2147483648/-1 +-9223372036854775808/-1 +-0 +-0.0 ++0 ++0.0 +0.00 +0..0 +. +0.0.0 +0,00 +0,,0 +, +0,0,0 +0.0/0 +1.0/0.0 +0.0/0.0 +1,0/0,0 +0,0/0,0 +--1 +- +-. +-, +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +-Infinity +INF +1#INF +-1#IND +1#QNAN +1#SNAN +1#IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1 000.00 +1'000.00 +1,000,000.00 +1 000 000.00 +1'000'000.00 +1.000,00 +1 000,00 +1'000,00 +1.000.000,00 +1 000 000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 + +# Special Characters +# +# ASCII punctuation. All of these characters may need to be escaped in some +# contexts. Divided into three groups based on (US-layout) keyboard position. + +,./;'[]\-= +<>?:"{}|_+ +!@#$%^&*()`~ + +# Non-whitespace C0 controls: U+0001 through U+0008, U+000E through U+001F, +# and U+007F (DEL) +# Often forbidden to appear in various text-based file formats (e.g. XML), +# or reused for internal delimiters on the theory that they should never +# appear in input. +# The next line may appear to be blank or mojibake in some viewers. + + +# Non-whitespace C1 controls: U+0080 through U+0084 and U+0086 through U+009F. +# Commonly misinterpreted as additional graphic characters. +# The next line may appear to be blank, mojibake, or dingbats in some viewers. +€‚ƒ„†‡ˆ‰Š‹ŒŽ‘’“”•–—˜™š›œžŸ + +# Whitespace: all of the characters with category Zs, Zl, or Zp (in Unicode +# version 8.0.0), plus U+0009 (HT), U+000B (VT), U+000C (FF), U+0085 (NEL), +# and U+200B (ZERO WIDTH SPACE), which are in the C categories but are often +# treated as whitespace in some contexts. +# This file unfortunately cannot express strings containing +# U+0000, U+000A, or U+000D (NUL, LF, CR). +# The next line may appear to be blank or mojibake in some viewers. +# The next line may be flagged for "trailing whitespace" in some viewers. + …             ​

  　 + +# Unicode additional control characters: all of the characters with +# general category Cf (in Unicode 8.0.0). +# The next line may appear to be blank or mojibake in some viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏‪‫‬‭‮⁠⁡⁢⁣⁤⁦⁧⁨⁩𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹󠀺󠀻󠀼󠀽󠀾󠀿󠁀󠁁󠁂󠁃󠁄󠁅󠁆󠁇󠁈󠁉󠁊󠁋󠁌󠁍󠁎󠁏󠁐󠁑󠁒󠁓󠁔󠁕󠁖󠁗󠁘󠁙󠁚󠁛󠁜󠁝󠁞󠁟󠁠󠁡󠁢󠁣󠁤󠁥󠁦󠁧󠁨󠁩󠁪󠁫󠁬󠁭󠁮󠁯󠁰󠁱󠁲󠁳󠁴󠁵󠁶󠁷󠁸󠁹󠁺󠁻󠁼󠁽󠁾󠁿 + +# "Byte order marks", U+FEFF and U+FFFE, each on its own line. +# The next two lines may appear to be blank or mojibake in some viewers. + +￾ + +# Unicode Symbols +# +# Strings which contain common unicode symbols (e.g. smart quotes) + +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +`⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ + +# Unicode Subscript/Superscript/Accents +# +# Strings which contain unicode subscripts/superscripts; can cause rendering issues + +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็ + +# Quotation Marks +# +# Strings which contain misplaced quotation marks; can cause encoding errors + +' +" +'' +"" +'"' +"''''"'" +"'"'"''''" +<foo val=“bar” /> +<foo val=“bar” /> +<foo val=”bar“ /> +<foo val=`bar' /> + +# Two-Byte Characters +# +# Strings which contain two-byte characters: can cause rendering issues or character-length issues + +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원 어학연구소 +찦차를 타고 온 펲시맨과 쑛다리 똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 + +# Strings which contain two-byte letters: can cause issues with naïve UTF-16 capitalizers which think that 16 bits == 1 character + +𐐜 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐙𐐊𐐡𐐝𐐓/𐐝𐐇𐐗𐐊𐐤𐐔 𐐒𐐋𐐗 𐐒𐐌 𐐜 𐐡𐐀𐐖𐐇𐐤𐐓𐐝 𐐱𐑂 𐑄 𐐔𐐇𐐝𐐀𐐡𐐇𐐓 𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 + +# Special Unicode Characters Union +# +# A super string recommended by VMware Inc. Globalization Team: can effectively cause rendering issues or character-length issues to validate product globalization readiness. +# +# 表 CJK_UNIFIED_IDEOGRAPHS (U+8868) +# ポ KATAKANA LETTER PO (U+30DD) +# あ HIRAGANA LETTER A (U+3042) +# A LATIN CAPITAL LETTER A (U+0041) +# 鷗 CJK_UNIFIED_IDEOGRAPHS (U+9DD7) +# Œ LATIN SMALL LIGATURE OE (U+0153) +# é LATIN SMALL LETTER E WITH ACUTE (U+00E9) +# Ｂ FULLWIDTH LATIN CAPITAL LETTER B (U+FF22) +# 逍 CJK_UNIFIED_IDEOGRAPHS (U+900D) +# Ü LATIN SMALL LETTER U WITH DIAERESIS (U+00FC) +# ß LATIN SMALL LETTER SHARP S (U+00DF) +# ª FEMININE ORDINAL INDICATOR (U+00AA) +# ą LATIN SMALL LETTER A WITH OGONEK (U+0105) +# ñ LATIN SMALL LETTER N WITH TILDE (U+00F1) +# 丂 CJK_UNIFIED_IDEOGRAPHS (U+4E02) +# 㐀 CJK Ideograph Extension A, First (U+3400) +# 𠀀 CJK Ideograph Extension B, First (U+20000) + +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 + +# Changing length when lowercased +# +# Characters which increase in length (2 to 3 bytes) when lowercased +# Credit: https://twitter.com/jifa/status/625776454479970304 + +Ⱥ +Ⱦ + +# Japanese Emoticons +# +# Strings which consists of Japanese-style emoticons which are popular on the web + +ヽ༼ຈل͜ຈ༽ﾉ ヽ༼ຈل͜ຈ༽ﾉ +(｡◕ ∀ ◕｡) +｀ｨ(´∀｀∩ +__ﾛ(,_,*) +・(￣∀￣)・:*: +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +,。・:*:・゜’( ☻ ω ☻ )。・:*:・゜’ +(╯°□°）╯︵ ┻━┻) +(ﾉಥ益ಥ）ﾉ ┻━┻ +┬─┬ノ( º _ ºノ) +( ͡° ͜ʖ ͡°) +¯\_(ツ)_/¯ + +# Emoji +# +# Strings which contain Emoji; should be the same behavior as two-byte characters, but not always + +😍 +👩🏽 +👨‍🦰 👨🏿‍🦰 👨‍🦱 👨🏿‍🦱 🦹🏿‍♂️ +👾 🙇 💁 🙅 🙆 🙋 🙎 🙍 +🐵 🙈 🙉 🙊 +❤️ 💔 💌 💕 💞 💓 💗 💖 💘 💝 💟 💜 💛 💚 💙 +✋🏿 💪🏿 👐🏿 🙌🏿 👏🏿 🙏🏿 +👨‍👩‍👦 👨‍👩‍👧‍👦 👨‍👨‍👦 👩‍👩‍👧 👨‍👦 👨‍👧‍👦 👩‍👦 👩‍👧‍👦 +🚾 🆒 🆓 🆕 🆖 🆗 🆙 🏧 +0️⃣ 1️⃣ 2️⃣ 3️⃣ 4️⃣ 5️⃣ 6️⃣ 7️⃣ 8️⃣ 9️⃣ 🔟 + +# Regional Indicator Symbols +# +# Regional Indicator Symbols can be displayed differently across +# fonts, and have a number of special behaviors + +🇺🇸🇷🇺🇸 🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 + +# Unicode Numbers +# +# Strings which contain unicode numbers; if the code is localized, it should see the input as numeric + +１２３ +١٢٣ + +# Right-To-Left Strings +# +# Strings which contain text that should be rendered RTL if possible (e.g. Arabic, Hebrew) + +ثم نفس سقطت وبالتحديد،, جزيرتي باستخدام أن دنو. إذ هنا؟ الستار وتنصيب كان. أهّل ايطاليا، بريطانيا-فرنسا قد أخذ. سليمان، إتفاقية بين ما, يذكر الحدود أي بعد, معاملة بولندا، الإطلاق عل إيو. +בְּרֵאשִׁית, בָּרָא אֱלֹהִים, אֵת הַשָּׁמַיִם, וְאֵת הָאָרֶץ +הָיְתָהtestالصفحات التّحول +﷽ +ﷺ +مُنَاقَشَةُ سُبُلِ اِسْتِخْدَامِ اللُّغَةِ فِي النُّظُمِ الْقَائِمَةِ وَفِيم يَخُصَّ التَّطْبِيقَاتُ الْحاسُوبِيَّةُ، +الكل في المجمو عة (5) + +# Ogham Text +# +# The only unicode alphabet to use a space which isn't empty but should still act like a space. + +᚛ᚄᚓᚐᚋᚒᚄ ᚑᚄᚂᚑᚏᚅ᚜ +᚛                 ᚜ + +# Trick Unicode +# +# Strings which contain unicode with unusual properties (e.g. Right-to-left override) (c.f. http://www.unicode.org/charts/PDF/U2000.pdf) + +‪‪test‪ +‫test‫ +
test
 +test⁠test‫ +⁦test⁧ + +# Zalgo Text +# +# Strings which contain "corrupted" text. The corruption will not appear in non-HTML text, however. (via http://www.eeemo.net) + +Ṱ̺̺̕o͞ ̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤ ̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎ ̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳ ̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠̣͟s̘͇̳͍̝͉e͉̥̯̞̲͚̬͜ǹ̬͎͎̟̖͇̤t͍̬̤͓̼̭͘ͅi̪̱n͠g̴͉ ͏͉ͅc̬̟h͡a̫̻̯͘o̫̟̖͍̙̝͉s̗̦̲.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎ ̰t͔̦h̞̲e̢̤ ͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍ ̨o͚̪͡f̘̣̬ ̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖̦̻͢.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔ ͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜ ̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟ ̯̲͕͞ǫ̟̯̰̲͙̻̝f ̪̰̰̗̖̭̘͘c̦͍̲̞͍̩̙ḥ͚a̮͎̟̙͜ơ̩̹͎s̤.̝̝ ҉Z̡̖̜͖̰̣͉̜a͖̰͙̬͡l̲̫̳͍̩g̡̟̼̱͚̞̬ͅo̗͜.̟ +̦H̬̤̗̤͝e͜ ̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮ ҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕ ̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖ ̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ ̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹̼̣l̴͔̰̤̟͔ḽ̫.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ + +# Unicode Upsidedown +# +# Strings which contain unicode with an "upsidedown" effect (via http://www.upsidedowntext.com) + +˙ɐnbᴉlɐ ɐuƃɐɯ ǝɹolop ʇǝ ǝɹoqɐl ʇn ʇunpᴉpᴉɔuᴉ ɹodɯǝʇ poɯsnᴉǝ op pǝs 'ʇᴉlǝ ƃuᴉɔsᴉdᴉpɐ ɹnʇǝʇɔǝsuoɔ 'ʇǝɯɐ ʇᴉs ɹolop ɯnsdᴉ ɯǝɹo˥ +00˙Ɩ$- + +# Unicode font +# +# Strings which contain bold/italic/etc. versions of normal characters + +Ｔｈｅ ｑｕｉｃｋ ｂｒｏｗｎ ｆｏｘ ｊｕｍｐｓ ｏｖｅｒ ｔｈｅ ｌａｚｙ ｄｏｇ +𝐓𝐡𝐞 𝐪𝐮𝐢𝐜𝐤 𝐛𝐫𝐨𝐰𝐧 𝐟𝐨𝐱 𝐣𝐮𝐦𝐩𝐬 𝐨𝐯𝐞𝐫 𝐭𝐡𝐞 𝐥𝐚𝐳𝐲 𝐝𝐨𝐠 +𝕿𝖍𝖊 𝖖𝖚𝖎𝖈𝖐 𝖇𝖗𝖔𝖜𝖓 𝖋𝖔𝖝 𝖏𝖚𝖒𝖕𝖘 𝖔𝖛𝖊𝖗 𝖙𝖍𝖊 𝖑𝖆𝖟𝖞 𝖉𝖔𝖌 +𝑻𝒉𝒆 𝒒𝒖𝒊𝒄𝒌 𝒃𝒓𝒐𝒘𝒏 𝒇𝒐𝒙 𝒋𝒖𝒎𝒑𝒔 𝒐𝒗𝒆𝒓 𝒕𝒉𝒆 𝒍𝒂𝒛𝒚 𝒅𝒐𝒈 +𝓣𝓱𝓮 𝓺𝓾𝓲𝓬𝓴 𝓫𝓻𝓸𝔀𝓷 𝓯𝓸𝔁 𝓳𝓾𝓶𝓹𝓼 𝓸𝓿𝓮𝓻 𝓽𝓱𝓮 𝓵𝓪𝔃𝔂 𝓭𝓸𝓰 +𝕋𝕙𝕖 𝕢𝕦𝕚𝕔𝕜 𝕓𝕣𝕠𝕨𝕟 𝕗𝕠𝕩 𝕛𝕦𝕞𝕡𝕤 𝕠𝕧𝕖𝕣 𝕥𝕙𝕖 𝕝𝕒𝕫𝕪 𝕕𝕠𝕘 +𝚃𝚑𝚎 𝚚𝚞𝚒𝚌𝚔 𝚋𝚛𝚘𝚠𝚗 𝚏𝚘𝚡 𝚓𝚞𝚖𝚙𝚜 𝚘𝚟𝚎𝚛 𝚝𝚑𝚎 𝚕𝚊𝚣𝚢 𝚍𝚘𝚐 +⒯⒣⒠ ⒬⒰⒤⒞⒦ ⒝⒭⒪⒲⒩ ⒡⒪⒳ ⒥⒰⒨⒫⒮ ⒪⒱⒠⒭ ⒯⒣⒠ ⒧⒜⒵⒴ ⒟⒪⒢ + +# Script Injection +# +# Strings which attempt to invoke a benign script injection; shows vulnerability to XSS + +<script>alert(0)</script> +<script>alert('1');</script> +<img src=x onerror=alert(2) /> +<svg><script>123<1>alert(3)</script> +"><script>alert(4)</script> +'><script>alert(5)</script> +><script>alert(6)</script> +</script><script>alert(7)</script> +< / script >< script >alert(8)< / script > + onfocus=JaVaSCript:alert(9) autofocus +" onfocus=JaVaSCript:alert(10) autofocus +' onfocus=JaVaSCript:alert(11) autofocus +＜script＞alert(12)＜/script＞ +<sc<script>ript>alert(13)</sc</script>ript> +--><script>alert(14)</script> +";alert(15);t=" +';alert(16);t=' +JavaSCript:alert(17) +;alert(18); +src=JaVaSCript:prompt(19) +"><script>alert(20);</script x=" +'><script>alert(21);</script x=' +><script>alert(22);</script x= +" autofocus onkeyup="javascript:alert(23) +' autofocus onkeyup='javascript:alert(24) +<script\x20type="text/javascript">javascript:alert(25);</script> +<script\x3Etype="text/javascript">javascript:alert(26);</script> +<script\x0Dtype="text/javascript">javascript:alert(27);</script> +<script\x09type="text/javascript">javascript:alert(28);</script> +<script\x0Ctype="text/javascript">javascript:alert(29);</script> +<script\x2Ftype="text/javascript">javascript:alert(30);</script> +<script\x0Atype="text/javascript">javascript:alert(31);</script> +'`"><\x3Cscript>javascript:alert(32)</script> +'`"><\x00script>javascript:alert(33)</script> +ABC<div style="x\x3Aexpression(javascript:alert(34)">DEF +ABC<div style="x:expression\x5C(javascript:alert(35)">DEF +ABC<div style="x:expression\x00(javascript:alert(36)">DEF +ABC<div style="x:exp\x00ression(javascript:alert(37)">DEF +ABC<div style="x:exp\x5Cression(javascript:alert(38)">DEF +ABC<div style="x:\x0Aexpression(javascript:alert(39)">DEF +ABC<div style="x:\x09expression(javascript:alert(40)">DEF +ABC<div style="x:\xE3\x80\x80expression(javascript:alert(41)">DEF +ABC<div style="x:\xE2\x80\x84expression(javascript:alert(42)">DEF +ABC<div style="x:\xC2\xA0expression(javascript:alert(43)">DEF +ABC<div style="x:\xE2\x80\x80expression(javascript:alert(44)">DEF +ABC<div style="x:\xE2\x80\x8Aexpression(javascript:alert(45)">DEF +ABC<div style="x:\x0Dexpression(javascript:alert(46)">DEF +ABC<div style="x:\x0Cexpression(javascript:alert(47)">DEF +ABC<div style="x:\xE2\x80\x87expression(javascript:alert(48)">DEF +ABC<div style="x:\xEF\xBB\xBFexpression(javascript:alert(49)">DEF +ABC<div style="x:\x20expression(javascript:alert(50)">DEF +ABC<div style="x:\xE2\x80\x88expression(javascript:alert(51)">DEF +ABC<div style="x:\x00expression(javascript:alert(52)">DEF +ABC<div style="x:\xE2\x80\x8Bexpression(javascript:alert(53)">DEF +ABC<div style="x:\xE2\x80\x86expression(javascript:alert(54)">DEF +ABC<div style="x:\xE2\x80\x85expression(javascript:alert(55)">DEF +ABC<div style="x:\xE2\x80\x82expression(javascript:alert(56)">DEF +ABC<div style="x:\x0Bexpression(javascript:alert(57)">DEF +ABC<div style="x:\xE2\x80\x81expression(javascript:alert(58)">DEF +ABC<div style="x:\xE2\x80\x83expression(javascript:alert(59)">DEF +ABC<div style="x:\xE2\x80\x89expression(javascript:alert(60)">DEF +<a href="\x0Bjavascript:javascript:alert(61)" id="fuzzelement1">test</a> +<a href="\x0Fjavascript:javascript:alert(62)" id="fuzzelement1">test</a> +<a href="\xC2\xA0javascript:javascript:alert(63)" id="fuzzelement1">test</a> +<a href="\x05javascript:javascript:alert(64)" id="fuzzelement1">test</a> +<a href="\xE1\xA0\x8Ejavascript:javascript:alert(65)" id="fuzzelement1">test</a> +<a href="\x18javascript:javascript:alert(66)" id="fuzzelement1">test</a> +<a href="\x11javascript:javascript:alert(67)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x88javascript:javascript:alert(68)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x89javascript:javascript:alert(69)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x80javascript:javascript:alert(70)" id="fuzzelement1">test</a> +<a href="\x17javascript:javascript:alert(71)" id="fuzzelement1">test</a> +<a href="\x03javascript:javascript:alert(72)" id="fuzzelement1">test</a> +<a href="\x0Ejavascript:javascript:alert(73)" id="fuzzelement1">test</a> +<a href="\x1Ajavascript:javascript:alert(74)" id="fuzzelement1">test</a> +<a href="\x00javascript:javascript:alert(75)" id="fuzzelement1">test</a> +<a href="\x10javascript:javascript:alert(76)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x82javascript:javascript:alert(77)" id="fuzzelement1">test</a> +<a href="\x20javascript:javascript:alert(78)" id="fuzzelement1">test</a> +<a href="\x13javascript:javascript:alert(79)" id="fuzzelement1">test</a> +<a href="\x09javascript:javascript:alert(80)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x8Ajavascript:javascript:alert(81)" id="fuzzelement1">test</a> +<a href="\x14javascript:javascript:alert(82)" id="fuzzelement1">test</a> +<a href="\x19javascript:javascript:alert(83)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xAFjavascript:javascript:alert(84)" id="fuzzelement1">test</a> +<a href="\x1Fjavascript:javascript:alert(85)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x81javascript:javascript:alert(86)" id="fuzzelement1">test</a> +<a href="\x1Djavascript:javascript:alert(87)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x87javascript:javascript:alert(88)" id="fuzzelement1">test</a> +<a href="\x07javascript:javascript:alert(89)" id="fuzzelement1">test</a> +<a href="\xE1\x9A\x80javascript:javascript:alert(90)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x83javascript:javascript:alert(91)" id="fuzzelement1">test</a> +<a href="\x04javascript:javascript:alert(92)" id="fuzzelement1">test</a> +<a href="\x01javascript:javascript:alert(93)" id="fuzzelement1">test</a> +<a href="\x08javascript:javascript:alert(94)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x84javascript:javascript:alert(95)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x86javascript:javascript:alert(96)" id="fuzzelement1">test</a> +<a href="\xE3\x80\x80javascript:javascript:alert(97)" id="fuzzelement1">test</a> +<a href="\x12javascript:javascript:alert(98)" id="fuzzelement1">test</a> +<a href="\x0Djavascript:javascript:alert(99)" id="fuzzelement1">test</a> +<a href="\x0Ajavascript:javascript:alert(100)" id="fuzzelement1">test</a> +<a href="\x0Cjavascript:javascript:alert(101)" id="fuzzelement1">test</a> +<a href="\x15javascript:javascript:alert(102)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA8javascript:javascript:alert(103)" id="fuzzelement1">test</a> +<a href="\x16javascript:javascript:alert(104)" id="fuzzelement1">test</a> +<a href="\x02javascript:javascript:alert(105)" id="fuzzelement1">test</a> +<a href="\x1Bjavascript:javascript:alert(106)" id="fuzzelement1">test</a> +<a href="\x06javascript:javascript:alert(107)" id="fuzzelement1">test</a> +<a href="\xE2\x80\xA9javascript:javascript:alert(108)" id="fuzzelement1">test</a> +<a href="\xE2\x80\x85javascript:javascript:alert(109)" id="fuzzelement1">test</a> +<a href="\x1Ejavascript:javascript:alert(110)" id="fuzzelement1">test</a> +<a href="\xE2\x81\x9Fjavascript:javascript:alert(111)" id="fuzzelement1">test</a> +<a href="\x1Cjavascript:javascript:alert(112)" id="fuzzelement1">test</a> +<a href="javascript\x00:javascript:alert(113)" id="fuzzelement1">test</a> +<a href="javascript\x3A:javascript:alert(114)" id="fuzzelement1">test</a> +<a href="javascript\x09:javascript:alert(115)" id="fuzzelement1">test</a> +<a href="javascript\x0D:javascript:alert(116)" id="fuzzelement1">test</a> +<a href="javascript\x0A:javascript:alert(117)" id="fuzzelement1">test</a> +`"'><img src=xxx:x \x0Aonerror=javascript:alert(118)> +`"'><img src=xxx:x \x22onerror=javascript:alert(119)> +`"'><img src=xxx:x \x0Bonerror=javascript:alert(120)> +`"'><img src=xxx:x \x0Donerror=javascript:alert(121)> +`"'><img src=xxx:x \x2Fonerror=javascript:alert(122)> +`"'><img src=xxx:x \x09onerror=javascript:alert(123)> +`"'><img src=xxx:x \x0Conerror=javascript:alert(124)> +`"'><img src=xxx:x \x00onerror=javascript:alert(125)> +`"'><img src=xxx:x \x27onerror=javascript:alert(126)> +`"'><img src=xxx:x \x20onerror=javascript:alert(127)> +"`'><script>\x3Bjavascript:alert(128)</script> +"`'><script>\x0Djavascript:alert(129)</script> +"`'><script>\xEF\xBB\xBFjavascript:alert(130)</script> +"`'><script>\xE2\x80\x81javascript:alert(131)</script> +"`'><script>\xE2\x80\x84javascript:alert(132)</script> +"`'><script>\xE3\x80\x80javascript:alert(133)</script> +"`'><script>\x09javascript:alert(134)</script> +"`'><script>\xE2\x80\x89javascript:alert(135)</script> +"`'><script>\xE2\x80\x85javascript:alert(136)</script> +"`'><script>\xE2\x80\x88javascript:alert(137)</script> +"`'><script>\x00javascript:alert(138)</script> +"`'><script>\xE2\x80\xA8javascript:alert(139)</script> +"`'><script>\xE2\x80\x8Ajavascript:alert(140)</script> +"`'><script>\xE1\x9A\x80javascript:alert(141)</script> +"`'><script>\x0Cjavascript:alert(142)</script> +"`'><script>\x2Bjavascript:alert(143)</script> +"`'><script>\xF0\x90\x96\x9Ajavascript:alert(144)</script> +"`'><script>-javascript:alert(145)</script> +"`'><script>\x0Ajavascript:alert(146)</script> +"`'><script>\xE2\x80\xAFjavascript:alert(147)</script> +"`'><script>\x7Ejavascript:alert(148)</script> +"`'><script>\xE2\x80\x87javascript:alert(149)</script> +"`'><script>\xE2\x81\x9Fjavascript:alert(150)</script> +"`'><script>\xE2\x80\xA9javascript:alert(151)</script> +"`'><script>\xC2\x85javascript:alert(152)</script> +"`'><script>\xEF\xBF\xAEjavascript:alert(153)</script> +"`'><script>\xE2\x80\x83javascript:alert(154)</script> +"`'><script>\xE2\x80\x8Bjavascript:alert(155)</script> +"`'><script>\xEF\xBF\xBEjavascript:alert(156)</script> +"`'><script>\xE2\x80\x80javascript:alert(157)</script> +"`'><script>\x21javascript:alert(158)</script> +"`'><script>\xE2\x80\x82javascript:alert(159)</script> +"`'><script>\xE2\x80\x86javascript:alert(160)</script> +"`'><script>\xE1\xA0\x8Ejavascript:alert(161)</script> +"`'><script>\x0Bjavascript:alert(162)</script> +"`'><script>\x20javascript:alert(163)</script> +"`'><script>\xC2\xA0javascript:alert(164)</script> +<img \x00src=x onerror="alert(165)"> +<img \x47src=x onerror="javascript:alert(166)"> +<img \x11src=x onerror="javascript:alert(167)"> +<img \x12src=x onerror="javascript:alert(168)"> +<img\x47src=x onerror="javascript:alert(169)"> +<img\x10src=x onerror="javascript:alert(170)"> +<img\x13src=x onerror="javascript:alert(171)"> +<img\x32src=x onerror="javascript:alert(172)"> +<img\x47src=x onerror="javascript:alert(173)"> +<img\x11src=x onerror="javascript:alert(174)"> +<img \x47src=x onerror="javascript:alert(175)"> +<img \x34src=x onerror="javascript:alert(176)"> +<img \x39src=x onerror="javascript:alert(177)"> +<img \x00src=x onerror="javascript:alert(178)"> +<img src\x09=x onerror="javascript:alert(179)"> +<img src\x10=x onerror="javascript:alert(180)"> +<img src\x13=x onerror="javascript:alert(181)"> +<img src\x32=x onerror="javascript:alert(182)"> +<img src\x12=x onerror="javascript:alert(183)"> +<img src\x11=x onerror="javascript:alert(184)"> +<img src\x00=x onerror="javascript:alert(185)"> +<img src\x47=x onerror="javascript:alert(186)"> +<img src=x\x09onerror="javascript:alert(187)"> +<img src=x\x10onerror="javascript:alert(188)"> +<img src=x\x11onerror="javascript:alert(189)"> +<img src=x\x12onerror="javascript:alert(190)"> +<img src=x\x13onerror="javascript:alert(191)"> +<img[a][b][c]src[d]=x[e]onerror=[f]"alert(192)"> +<img src=x onerror=\x09"javascript:alert(193)"> +<img src=x onerror=\x10"javascript:alert(194)"> +<img src=x onerror=\x11"javascript:alert(195)"> +<img src=x onerror=\x12"javascript:alert(196)"> +<img src=x onerror=\x32"javascript:alert(197)"> +<img src=x onerror=\x00"javascript:alert(198)"> +<a href=java script:javascript:alert(199)>XXX</a> +<img src="x` `<script>javascript:alert(200)</script>"` `> +<img src onerror /" '"= alt=javascript:alert(201)//"> +<title onpropertychange=javascript:alert(202)> +<a href=http://foo.bar/#x=`y></a><img alt="`><img src=x:x onerror=javascript:alert(203)></a>"> +<!--[if]><script>javascript:alert(204)</script --> +<!--[if<img src=x onerror=javascript:alert(205)//]> --> +<script src="/\%(jscript)s"></script> +<script src="\\%(jscript)s"></script> +<IMG """><SCRIPT>alert("206")</SCRIPT>"> +<IMG SRC=javascript:alert(String.fromCharCode(50,48,55))> +<IMG SRC=# onmouseover="alert('208')"> +<IMG SRC= onmouseover="alert('209')"> +<IMG onmouseover="alert('210')"> +<IMG SRC=javascript:alert('211')> +<IMG SRC=javascript:alert('212')> +<IMG SRC=javascript:alert('213')> +<IMG SRC="jav   ascript:alert('214');"> +<IMG SRC="jav ascript:alert('215');"> +<IMG SRC="jav ascript:alert('216');"> +<IMG SRC="jav ascript:alert('217');"> +perl -e 'print "<IMG SRC=java\0script:alert(\"218\")>";' > out +<IMG SRC="   javascript:alert('219');"> +<SCRIPT/XSS SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<BODY onload!#$%&()*~+-_.,:;?@[/|\]^`=alert("220")> +<SCRIPT/SRC="http://ha.ckers.org/xss.js"></SCRIPT> +<<SCRIPT>alert("221");//<</SCRIPT> +<SCRIPT SRC=http://ha.ckers.org/xss.js?< B > +<SCRIPT SRC=//ha.ckers.org/.j> +<IMG SRC="javascript:alert('222')" +<iframe src=http://ha.ckers.org/scriptlet.html < +\";alert('223');// +<u oncopy=alert()> Copy me</u> +<i onwheel=alert(224)> Scroll over me </i> +<plaintext> +http://a/%%30%30 +</textarea><script>alert(225)</script> + +# SQL Injection +# +# Strings which can cause a SQL injection if inputs are not sanitized + +1;DROP TABLE users +1'; DROP TABLE users-- 1 +' OR 1=1 -- 1 +' OR '1'='1 +'; EXEC sp_MSForEachTable 'DROP TABLE ?'; -- + +% +_ + +# Server Code Injection +# +# Strings which can cause user to run code on server as a privileged user (c.f. https://news.ycombinator.com/item?id=7665153) + +- +-- +--version +--help +$USER +/dev/null; touch /tmp/blns.fail ; echo +`touch /tmp/blns.fail` +$(touch /tmp/blns.fail) +@{[system "touch /tmp/blns.fail"]} + +# Command Injection (Ruby) +# +# Strings which can call system commands within Ruby/Rails applications + +eval("puts 'hello world'") +System("ls -al /") +`ls -al /` +Kernel.exec("ls -al /") +Kernel.exit(1) +%x('ls -al /') + +# XXE Injection (XML) +# +# String which can reveal system files when parsed by a badly configured XML parser + +<?xml version="1.0" encoding="ISO-8859-1"?><!DOCTYPE foo [ <!ELEMENT foo ANY ><!ENTITY xxe SYSTEM "file:///etc/passwd" >]><foo>&xxe;</foo> + +# Unwanted Interpolation +# +# Strings which can be accidentally expanded into different strings if evaluated in the wrong context, e.g. used as a printf format string or via Perl or shell eval. Might expose sensitive data from the program doing the interpolation, or might just represent the wrong string. + +$HOME +$ENV{'HOME'} +%d +%s%s%s%s%s +{0} +%*.*s +%@ +%n +File:/// + +# File Inclusion +# +# Strings which can cause user to pull in files that should not be a part of a web server + +../../../../../../../../../../../etc/passwd%00 +../../../../../../../../../../../etc/hosts + +# Known CVEs and Vulnerabilities +# +# Strings that test for known vulnerabilities + +() { 0; }; touch /tmp/blns.shellshock1.fail; +() { _; } >_[$($())] { touch /tmp/blns.shellshock2.fail; } +<<< %s(un='%s') = %u ++++ATH0 + +# MSDOS/Windows Special Filenames +# +# Strings which are reserved characters in MSDOS/Windows + +CON +PRN +AUX +CLOCK$ +NUL +A: +ZZ: +COM1 +LPT1 +LPT2 +LPT3 +COM2 +COM3 +COM4 + +# IRC specific strings +# +# Strings that may occur on IRC clients that make security products freak out + +DCC SEND STARTKEYLOGGER 0 0 0 + +# Scunthorpe Problem +# +# Innocuous strings which may be blocked by profanity filters (https://en.wikipedia.org/wiki/Scunthorpe_problem) + +Scunthorpe General Hospital +Penistone Community Church +Lightwater Country Park +Jimmy Clitheroe +Horniman Museum +shitake mushrooms +RomansInSussex.co.uk +http://www.cum.qc.ca/ +Craig Cockburn, Software Specialist +Linda Callahan +Dr. Herman I. Libshitz +magna cum laude +Super Bowl XXX +medieval erection of parapets +evaluate +mocha +expression +Arsenal canal +classic +Tyson Gay +Dick Van Dyke +basement + +# Human injection +# +# Strings which may cause human to reinterpret worldview + +If you're reading this, you've been in a coma for almost 20 years now. We're trying a new technique. We don't know where this message will end up in your dream, but we hope it works. Please wake up, we miss you. + +# Terminal escape codes +# +# Strings which punish the fools who use cat/type on this file + +Roses are red, violets are blue. Hope you enjoy terminal hue +But now...for my greatest trick... +The quick brown fox... [Beeeep] + +# iOS Vulnerabilities +# +# Strings which crashed iMessage in various versions of iOS + +Powerلُلُصّبُلُلصّبُررً ॣ ॣh ॣ ॣ冗 +🏳0🌈️ +జ్ఞ‌ా + +# Persian special characters +# +# This is a four characters string which includes Persian special characters (گچپژ) + +گچپژ + +# jinja2 injection +# +# first one is supposed to raise "MemoryError" exception +# second, obviously, prints contents of /etc/passwd + +{% print 'x' * 64 * 1024**3 %} +{{ "".__class__.__mro__[2].__subclasses__()[40]("/etc/passwd").read() }} diff --git a/tests/blns.url_safe.capacity b/tests/blns.url_safe.capacity new file mode 100644 index 0000000..a64f1d6 --- /dev/null +++ b/tests/blns.url_safe.capacity @@ -0,0 +1,742 @@ +19 +2 +46 +1 +10 +6 +5 +5 +7 +4 +4 +5 +6 +5 +6 +5 +6 +5 +15 +5 +12 +2 +3 +1 +18 +2 +46 +1 +2 +2 +5 +5 +4 +4 +5 +6 +3 +5 +7 +5 +5 +6 +7 +4 +4 +15 +24 +3 +5 +3 +5 +5 +5 +1 +6 +5 +5 +2 +6 +5 +7 +7 +8 +8 +4 +2 +2 +3 +97 +4 +9 +10 +4 +6 +7 +7 +7 +6 +4 +11 +19 +11 +40 +8 +8 +8 +12 +12 +12 +8 +9 +9 +12 +13 +13 +6 +3 +3 +23 +1 +21 +2 +76 +78 +1 +10 +11 +13 +1 +76 +19 +74 +73 +18 +67 +28 +1 +78 +59 +78 +63 +1 +76 +75 +77 +41 +60 +42 +67 +73 +63 +1 +68 +41 +67 +256 +1 +62 +72 +4 +4 +1 +18 +2 +66 +1 +26 +26 +29 +30 +22 +27 +30 +35 +13 +159 +21 +1 +40 +2 +84 +1 +10 +10 +19 +256 +1 +18 +2 +77 +1 +2 +2 +3 +3 +4 +9 +11 +22 +22 +22 +18 +1 +22 +2 +99 +1 +34 +34 +13 +10 +32 +57 +31 +16 +29 +1 +131 +1 +228 +1 +35 +2 +174 +2 +47 +43 +42 +46 +47 +49 +56 +58 +47 +60 +51 +51 +57 +56 +47 +57 +59 +1 +44 +1 +34 +2 +69 +60 +1 +3 +3 +1 +21 +2 +82 +1 +46 +20 +19 +12 +21 +45 +52 +32 +33 +26 +18 +14 +1 +8 +2 +98 +1 +5 +9 +74 +40 +20 +77 +53 +145 +40 +85 +1 +35 +2 +71 +54 +1 +42 +37 +25 +1 +18 +2 +102 +1 +10 +7 +1 +24 +2 +90 +1 +256 +112 +48 +4 +4 +225 +36 +1 +13 +2 +95 +1 +46 +58 +1 +16 +2 +136 +1 +14 +11 +11 +15 +11 +1 +13 +2 +126 +1 +264 +260 +258 +258 +52 +1 +21 +2 +95 +1 +193 +9 +1 +15 +2 +70 +1 +114 +149 +149 +149 +149 +149 +149 +114 +1 +19 +2 +88 +1 +26 +49 +31 +37 +28 +28 +27 +35 +43 +40 +41 +41 +35 +44 +30 +16 +16 +21 +12 +26 +33 +33 +31 +42 +42 +65 +65 +65 +65 +65 +65 +65 +46 +46 +57 +58 +58 +58 +58 +58 +58 +66 +66 +62 +66 +66 +58 +58 +66 +66 +58 +66 +58 +66 +66 +66 +66 +58 +66 +66 +66 +73 +73 +77 +73 +81 +73 +73 +81 +81 +81 +73 +73 +73 +73 +73 +73 +81 +73 +73 +73 +81 +73 +73 +81 +73 +81 +73 +81 +73 +81 +81 +73 +73 +73 +81 +81 +81 +73 +73 +74 +74 +74 +82 +74 +74 +74 +74 +82 +82 +74 +82 +74 +74 +74 +74 +74 +74 +54 +54 +54 +54 +54 +54 +54 +54 +54 +54 +47 +47 +55 +55 +55 +55 +47 +55 +55 +55 +47 +55 +55 +55 +47 +47 +59 +44 +47 +55 +47 +55 +55 +55 +51 +55 +55 +55 +55 +55 +47 +55 +55 +55 +47 +47 +51 +37 +48 +48 +48 +47 +47 +47 +47 +47 +47 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +48 +47 +47 +47 +47 +47 +49 +48 +48 +48 +48 +48 +48 +81 +58 +54 +69 +94 +51 +56 +38 +38 +41 +57 +39 +38 +33 +137 +218 +126 +41 +43 +43 +43 +63 +46 +54 +51 +50 +35 +44 +30 +35 +48 +19 +31 +43 +12 +17 +39 +1 +16 +2 +70 +1 +19 +25 +14 +12 +45 +2 +2 +2 +1 +24 +2 +125 +1 +2 +3 +10 +7 +6 +38 +22 +23 +34 +1 +27 +2 +72 +1 +27 +19 +11 +23 +14 +15 +1 +27 +2 +84 +1 +138 +1 +25 +2 +256 +1 +6 +13 +3 +11 +4 +5 +3 +3 +9 +1 +17 +2 +90 +1 +46 +42 +1 +33 +2 +46 +1 +44 +58 +21 +8 +1 +34 +2 +57 +1 +4 +4 +4 +7 +4 +3 +4 +5 +5 +5 +5 +5 +5 +5 +1 +25 +2 +80 +1 +30 +1 +21 +2 +112 +1 +28 +27 +24 +16 +16 +18 +20 +21 +36 +15 +22 +16 +15 +30 +9 +6 +11 +14 +8 +10 +14 +9 +1 +18 +2 +57 +1 +211 +1 +24 +2 +63 +1 +78 +43 +48 +1 +22 +2 +60 +1 +62 +13 +16 +1 +29 +2 +88 +1 +9 +1 +19 +2 +57 +52 +1 +31 +72 diff --git a/tests/blns.url_safe.sanitised b/tests/blns.url_safe.sanitised new file mode 100644 index 0000000..1461afe --- /dev/null +++ b/tests/blns.url_safe.sanitised @@ -0,0 +1,742 @@ +Reserved_Strings +_ +Strings_which_may_be_used_elsewhere_in_code +_ +undefined +undef +null +NULL +(null) +nil +NIL +true +false +True +False +TRUE +FALSE +None +hasOwnProperty +then +constructor +_ +_ +_ +Numeric_Strings +_ +Strings_which_can_be_interpreted_as_numeric +_ +0 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1 +1.00 +$1.00 +1_2 +1E2 +1E02 +1E+02 +1_0 +0_0 +2147483648_-1 +9223372036854775808_-1 +0 +0.0 ++0 ++0.0 +0.00 +0.0 +_ +0.0.0 +0,00 +0,,0 +_ +0,0,0 +0.0_0 +1.0_0.0 +0.0_0.0 +1,0_0,0 +0,0_0,0 +1 +_ +_ +_ +999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999999 +NaN +Infinity +Infinity +INF +1_INF +1_IND +1_QNAN +1_SNAN +1_IND +0x0 +0xffffffff +0xffffffffffffffff +0xabad1dea +123456789012345678901234567890123456789 +1,000.00 +1_000.00 +1'000.00 +1,000,000.00 +1_000_000.00 +1'000'000.00 +1.000,00 +1_000,00 +1'000,00 +1.000.000,00 +1_000_000,00 +1'000'000,00 +01000 +08 +09 +2.2250738585072011e-308 +_ +Special_Characters +_ +ASCII_punctuation.All_of_these_characters_may_need_to_be_escaped_in_some +contexts.__Divided_into_three_groups_based_on_(US-layout)_keyboard_position. +_ +.'___-= ++ +!@_$____()_~ +_ +Non-whitespace_C0_controls__U+0001_through_U+0008,_U+000E_through_U+001F +and_U+007F_(DEL) +Often_forbidden_to_appear_in_various_text-based_file_formats_(e.g.XML) +or_reused_for_internal_delimiters_on_the_theory_that_they_should_never +appear_in_input. +The_next_line_may_appear_to_be_blank_or_mojibake_in_some_viewers. +_ +_ +Non-whitespace_C1_controls__U+0080_through_U+0084_and_U+0086_through_U+009F. +Commonly_misinterpreted_as_additional_graphic_characters. +The_next_line_may_appear_to_be_blank,_mojibake,_or_dingbats_in_some_viewers. +_ +_ +Whitespace__all_of_the_characters_with_category_Zs,_Zl,_or_Zp_(in_Unicode +version_8.0.0),_plus_U+0009_(HT),_U+000B_(VT),_U+000C_(FF),_U+0085_(NEL) +and_U+200B_(ZERO_WIDTH_SPACE),_which_are_in_the_C_categories_but_are_often +treated_as_whitespace_in_some_contexts. +This_file_unfortunately_cannot_express_strings_containing +U+0000,_U+000A,_or_U+000D_(NUL,_LF,_CR). +The_next_line_may_appear_to_be_blank_or_mojibake_in_some_viewers. +The_next_line_may_be_flagged_for__trailing_whitespace__in_some_viewers. +​ +_ +Unicode_additional_control_characters__all_of_the_characters_with +general_category_Cf_(in_Unicode_8.0.0). +The_next_line_may_appear_to_be_blank_or_mojibake_in_some_viewers. +­؀؁؂؃؄؅؜۝܏᠎​‌‍‎‏_____⁠⁡⁢⁣⁤____𑂽𛲠𛲡𛲢𛲣𝅳𝅴𝅵𝅶𝅷𝅸𝅹𝅺󠀁󠀠󠀡󠀢󠀣󠀤󠀥󠀦󠀧󠀨󠀩󠀪󠀫󠀬󠀭󠀮󠀯󠀰󠀱󠀲󠀳󠀴󠀵󠀶󠀷󠀸󠀹 +_ +Byte_order_marks_,_U+FEFF_and_U+FFFE,_each_on_its_own_line. +The_next_two_lines_may_appear_to_be_blank_or_mojibake_in_some_viewers. + +_ +_ +Unicode_Symbols +_ +Strings_which_contain_common_unicode_symbols_(e.g.smart_quotes) +_ +Ω≈ç√∫˜µ≤≥÷ +åß∂ƒ©˙∆˚¬…æ +œ∑´®†¥¨ˆøπ“‘ +¡™£¢∞§¶•ªº–≠ +¸˛Ç◊ı˜Â¯˘¿ +ÅÍÎÏ˝ÓÔÒÚÆ☃ +Œ„´‰ˇÁ¨ˆØ∏”’ +⁄€‹›fifl‡°·‚—± +⅛⅜⅝⅞ +ЁЂЃЄЅІЇЈЉЊЋЌЍЎЏАБВГДЕЖЗИЙКЛМНОПРСТУФХЦЧШЩЪЫЬЭЮЯабвгдежзийклмнопрстуфхцчшщъыьэюя +٠١٢٣٤٥٦٧٨٩ +_ +Unicode_Subscript_Superscript_Accents +_ +Strings_which_contain_unicode_subscripts_superscripts;_can_cause_rendering_issues +_ +⁰⁴⁵ +₀₁₂ +⁰⁴⁵₀₁₂ +ด้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้็็็็็้้้้้้้้็็็็็้้้้้ +_ +Quotation_Marks +_ +Strings_which_contain_misplaced_quotation_marks;_can_cause_encoding_errors +_ +' +_ +'' +_ +'_' +''''_' +'_'_'''' +foo_val=“bar” +foo_val=“bar” +foo_val=”bar“ +foo_val=_bar' +_ +Two-Byte_Characters +_ +Strings_which_contain_two-byte_characters__can_cause_rendering_issues_or_character-length_issues +_ +田中さんにあげて下さい +パーティーへ行かないか +和製漢語 +部落格 +사회과학원_어학연구소 +찦차를_타고_온_펲시맨과_쑛다리_똠방각하 +社會科學院語學研究所 +울란바토르 +𠜎𠜱𠝹𠱓𠱸𠲖𠳏 +_ +Strings_which_contain_two-byte_letters__can_cause_issues_with_naïve_UTF-16_capitalizers_which_think_that_16_bits_==_1_character +_ +𐐜_𐐔𐐇𐐝𐐀𐐡𐐇𐐓_𐐙𐐊𐐡𐐝𐐓_𐐝𐐇𐐗𐐊𐐤𐐔_𐐒𐐋𐐗_𐐒𐐌_𐐜_𐐡𐐀𐐖𐐇𐐤𐐓𐐝_𐐱𐑂_𐑄_𐐔𐐇𐐝𐐀𐐡𐐇𐐓_𐐏𐐆𐐅𐐤𐐆𐐚𐐊𐐡𐐝𐐆𐐓𐐆 +_ +Special_Unicode_Characters_Union +_ +A_super_string_recommended_by_VMware_Inc._Globalization_Team__can_effectively_cause_rendering_issues_or_character-length_issues_to_validate_product_globalization_readiness. +_ +表__________CJK_UNIFIED_IDEOGRAPHS_(U+8868) +ポ__________KATAKANA_LETTER_PO_(U+30DD) +あ__________HIRAGANA_LETTER_A_(U+3042) +A___________LATIN_CAPITAL_LETTER_A_(U+0041) +鷗__________CJK_UNIFIED_IDEOGRAPHS_(U+9DD7) +Œ___________LATIN_SMALL_LIGATURE_OE_(U+0153) +é___________LATIN_SMALL_LETTER_E_WITH_ACUTE_(U+00E9) +Ｂ___________FULLWIDTH_LATIN_CAPITAL_LETTER_B_(U+FF22) +逍__________CJK_UNIFIED_IDEOGRAPHS_(U+900D) +Ü___________LATIN_SMALL_LETTER_U_WITH_DIAERESIS_(U+00FC) +ß___________LATIN_SMALL_LETTER_SHARP_S_(U+00DF) +ª___________FEMININE_ORDINAL_INDICATOR_(U+00AA) +ą___________LATIN_SMALL_LETTER_A_WITH_OGONEK_(U+0105) +ñ___________LATIN_SMALL_LETTER_N_WITH_TILDE_(U+00F1) +丂__________CJK_UNIFIED_IDEOGRAPHS_(U+4E02) +㐀__________CJK_Ideograph_Extension_A,_First_(U+3400) +𠀀__________CJK_Ideograph_Extension_B,_First_(U+20000) +_ +表ポあA鷗ŒéＢ逍Üߪąñ丂㐀𠀀 +_ +Changing_length_when_lowercased +_ +Characters_which_increase_in_length_(2_to_3_bytes)_when_lowercased +Credit__https___twitter.com_jifa_status_625776454479970304 +_ +Ⱥ +Ⱦ +_ +Japanese_Emoticons +_ +Strings_which_consists_of_Japanese-style_emoticons_which_are_popular_on_the_web +_ +ヽ༼ຈل͜ຈ༽ﾉ_ヽ༼ຈل͜ຈ༽ﾉ +(｡◕_∀_◕｡) +｀ｨ(´∀｀∩ +ﾛ(,_,_) +・(￣∀￣)・ +ﾟ･✿ヾ╲(｡◕‿◕｡)╱✿･ﾟ +。・___・゜’(_☻_ω_☻_)。・___・゜’ +(╯°□°）╯︵_┻━┻) +(ﾉಥ益ಥ）ﾉ_┻━┻ +┬─┬ノ(_º___ºノ) +(_͡°_͜ʖ_͡°) +¯__(ツ)__¯ +_ +Emoji +_ +Strings_which_contain_Emoji;_should_be_the_same_behavior_as_two-byte_characters,_but_not_always +_ +😍 +👩🏽 +👨‍🦰_👨🏿‍🦰_👨‍🦱_👨🏿‍🦱_🦹🏿‍♂️ +👾_🙇_💁_🙅_🙆_🙋_🙎_🙍 +🐵_🙈_🙉_🙊 +❤️_💔_💌_💕_💞_💓_💗_💖_💘_💝_💟_💜_💛_💚_💙 +✋🏿_💪🏿_👐🏿_🙌🏿_👏🏿_🙏🏿 +👨‍👩‍👦_👨‍👩‍👧‍👦_👨‍👨‍👦_👩‍👩‍👧_👨‍👦_👨‍👧‍👦_👩‍👦_👩‍👧‍👦 +🚾_🆒_🆓_🆕_🆖_🆗_🆙_🏧 +0️⃣_1️⃣_2️⃣_3️⃣_4️⃣_5️⃣_6️⃣_7️⃣_8️⃣_9️⃣_🔟 +_ +Regional_Indicator_Symbols +_ +Regional_Indicator_Symbols_can_be_displayed_differently_across +fonts,_and_have_a_number_of_special_behaviors +_ +🇺🇸🇷🇺🇸_🇦🇫🇦🇲🇸 +🇺🇸🇷🇺🇸🇦🇫🇦🇲 +🇺🇸🇷🇺🇸🇦 +_ +Unicode_Numbers +_ +Strings_which_contain_unicode_numbers;_if_the_code_is_localized,_it_should_see_the_input_as_numeric +_ +１２３ +١٢٣ +_ +Right-To-Left_Strings +_ +Strings_which_contain_text_that_should_be_rendered_RTL_if_possible_(e.g.Arabic,_Hebrew) +_ +ثم_نفس_سقطت_وبالتحديد،,_جزيرتي_باستخدام_أن_دنو._إذ_هنا؟_الستار_وتنصيب_كان._أهّل_ايطاليا،_بريطانيا-فرنسا_قد_أخذ._سليمان،_إتفاقية_بين_ما,_يذكر. +בְּרֵאשִׁית,_בָּרָא_אֱלֹהִים,_אֵת_הַשָּׁמַיִם,_וְאֵת_הָאָרֶץ +הָיְתָהtestالصفحات_التّحول +﷽ +ﷺ +مُنَاقَشَةُ_سُبُلِ_اِسْتِخْدَامِ_اللُّغَةِ_فِي_النُّظُمِ_الْقَائِمَةِ_وَفِيم_يَخُصَّ_التَّطْبِيقَاتُ_الْحاسُوبِيَّةُ، +الكل_في_المجمو_عة_(5) +_ +Ogham_Text +_ +The_only_unicode_alphabet_to_use_a_space_which_isn't_empty_but_should_still_act_like_a_space. +_ +᚛ᚄᚓᚐᚋᚒᚄ_ᚑᚄᚂᚑᚏᚅ᚜ +᚛_________________᚜ +_ +Trick_Unicode +_ +Strings_which_contain_unicode_with_unusual_properties_(e.g._Right-to-left_override)_(c.f._http___www.unicode.org_charts_PDF_U2000.pdf) +_ +test +test +test +test⁠test +test +_ +Zalgo_Text +_ +Strings_which_contain__corrupted__text._The_corruption_will_not_appear_in_non-HTML_text,_however._(via_http___www.eeemo.net) +_ +Ṱ̺̺̕o͞_̷i̲̬͇̪͙n̝̗͕v̟̜̘̦͟o̶̙̰̠kè͚̮̺̪̹̱̤_̖t̝͕̳̣̻̪͞h̼͓̲̦̳̘̲e͇̣̰̦̬͎_̢̼̻̱̘h͚͎͙̜̣̲ͅi̦̲̣̰̤v̻͍e̺̭̳̪̰-m̢iͅn̖̺̞̲̯̰d̵̼̟͙̩̼̘̳_̞̥̱̳̭r̛̗̘e͙p͠r̼̞̻̭̗e̺̠.̨̹͈̣ +̡͓̞ͅI̗̘̦͝n͇͇͙v̮̫ok̲̫̙͈i̖͙̭̹̠̞n̡̻̮̣̺g̲͈͙̭͙̬͎_̰t͔̦h̞̲e̢̤_͍̬̲͖f̴̘͕̣è͖ẹ̥̩l͖͔͚i͓͚̦͠n͖͍̗͓̳̮g͍_̨o͚̪͡f̘̣̬_̖̘͖̟͙̮c҉͔̫͖͓͇͖ͅh̵̤̣͚͔á̗̼͕ͅo̼̣̥s̱͈̺̖.̛̖̞̠̫̰ +̗̺͖̹̯͓Ṯ̤͍̥͇͈h̲́e͏͓̼̗̙̼̣͔_͇̜̱̠͓͍ͅN͕͠e̗̱z̘̝̜̺͙p̤̺̹͍̯͚e̠̻̠͜r̨̤͍̺̖͔̖̖d̠̟̭̬̝͟i̦͖̩͓͔̤a̠̗̬͉̙n͚͜_̻̞̰͚ͅh̵͉i̳̞v̢͇ḙ͎͟-҉̭̩̼͔m̤̭̫i͕͇̝̦n̗͙ḍ̟_̯̲͕͞ǫ̟̯̰.̟ +̦H̬̤̗̤͝e͜_̜̥̝̻͍̟́w̕h̖̯͓o̝͙̖͎̱̮_҉̺̙̞̟͈W̷̼̭a̺̪͍į͈͕̭͙̯̜t̶̼̮s̘͙͖̕_̠̫̠B̻͍͙͉̳ͅe̵h̵̬͇̫͙i̹͓̳̳̮͎̫̕n͟d̴̪̜̖_̰͉̩͇͙̲͞ͅT͖̼͓̪͢h͏͓̮̻e̬̝̟ͅ_̤̹̝W͙̞̝͔͇͝ͅa͏͓͔̹.͕ +Z̮̞̠͙͔ͅḀ̗̞͈̻̗Ḷ͙͎̯̹̞͓G̻O̭̗̮ +_ +Unicode_Upsidedown +_ +Strings_which_contain_unicode_with_an__upsidedown__effect_(via_http___www.upsidedowntext.com) +_ +˙ɐnbᴉlɐ_ɐuƃɐɯ_ǝɹolop_ʇǝ_ǝɹoqɐl_ʇn_ʇunpᴉpᴉɔuᴉ_ɹodɯǝʇ_poɯsnᴉǝ_op_pǝs_'ʇᴉlǝ_ƃuᴉɔsᴉdᴉpɐ_ɹnʇǝʇɔǝsuoɔ_'ʇǝɯɐ_ʇᴉs_ɹolop_ɯnsdᴉ_ɯǝɹo˥ +00˙Ɩ$ +_ +Unicode_font +_ +Strings_which_contain_bold_italic_etc.versions_of_normal_characters +_ +Ｔｈｅ_ｑｕｉｃｋ_ｂｒｏｗｎ_ｆｏｘ_ｊｕｍｐｓ_ｏｖｅｒ_ｔｈｅ_ｌａｚｙ_ｄｏｇ +𝐓𝐡𝐞_𝐪𝐮𝐢𝐜𝐤_𝐛𝐫𝐨𝐰𝐧_𝐟𝐨𝐱_𝐣𝐮𝐦𝐩𝐬_𝐨𝐯𝐞𝐫_𝐭𝐡𝐞_𝐥𝐚𝐳𝐲_𝐝𝐨𝐠 +𝕿𝖍𝖊_𝖖𝖚𝖎𝖈𝖐_𝖇𝖗𝖔𝖜𝖓_𝖋𝖔𝖝_𝖏𝖚𝖒𝖕𝖘_𝖔𝖛𝖊𝖗_𝖙𝖍𝖊_𝖑𝖆𝖟𝖞_𝖉𝖔𝖌 +𝑻𝒉𝒆_𝒒𝒖𝒊𝒄𝒌_𝒃𝒓𝒐𝒘𝒏_𝒇𝒐𝒙_𝒋𝒖𝒎𝒑𝒔_𝒐𝒗𝒆𝒓_𝒕𝒉𝒆_𝒍𝒂𝒛𝒚_𝒅𝒐𝒈 +𝓣𝓱𝓮_𝓺𝓾𝓲𝓬𝓴_𝓫𝓻𝓸𝔀𝓷_𝓯𝓸𝔁_𝓳𝓾𝓶𝓹𝓼_𝓸𝓿𝓮𝓻_𝓽𝓱𝓮_𝓵𝓪𝔃𝔂_𝓭𝓸𝓰 +𝕋𝕙𝕖_𝕢𝕦𝕚𝕔𝕜_𝕓𝕣𝕠𝕨𝕟_𝕗𝕠𝕩_𝕛𝕦𝕞𝕡𝕤_𝕠𝕧𝕖𝕣_𝕥𝕙𝕖_𝕝𝕒𝕫𝕪_𝕕𝕠𝕘 +𝚃𝚑𝚎_𝚚𝚞𝚒𝚌𝚔_𝚋𝚛𝚘𝚠𝚗_𝚏𝚘𝚡_𝚓𝚞𝚖𝚙𝚜_𝚘𝚟𝚎𝚛_𝚝𝚑𝚎_𝚕𝚊𝚣𝚢_𝚍𝚘𝚐 +⒯⒣⒠_⒬⒰⒤⒞⒦_⒝⒭⒪⒲⒩_⒡⒪⒳_⒥⒰⒨⒫⒮_⒪⒱⒠⒭_⒯⒣⒠_⒧⒜⒵⒴_⒟⒪⒢ +_ +Script_Injection +_ +Strings_which_attempt_to_invoke_a_benign_script_injection;_shows_vulnerability_to_XSS +_ +script_alert(0)__script +lt;script_gt;alert(__39;1__39;);_lt;_script_gt +img_src=x_onerror=alert(2) +svg__script_123_1_alert(3)__script +script_alert(4)__script +'__script_alert(5)__script +script_alert(6)__script +script__script_alert(7)__script +script____script__alert(8)____script +onfocus=JaVaSCript_alert(9)_autofocus +onfocus=JaVaSCript_alert(10)_autofocus +'_onfocus=JaVaSCript_alert(11)_autofocus +＜script＞alert(12)＜_script＞ +sc_script_ript_alert(13)__sc__script_ript +script_alert(14)__script +alert(15);t= +';alert(16);t=' +JavaSCript_alert(17) +alert(18) +src=JaVaSCript_prompt(19) +script_alert(20);__script_x= +'__script_alert(21);__script_x=' +script_alert(22);__script_x= +autofocus_onkeyup=_javascript_alert(23) +'_autofocus_onkeyup='javascript_alert(24) +script_x20type=_text_javascript__javascript_alert(25);__script +script_x3Etype=_text_javascript__javascript_alert(26);__script +script_x0Dtype=_text_javascript__javascript_alert(27);__script +script_x09type=_text_javascript__javascript_alert(28);__script +script_x0Ctype=_text_javascript__javascript_alert(29);__script +script_x2Ftype=_text_javascript__javascript_alert(30);__script +script_x0Atype=_text_javascript__javascript_alert(31);__script +'_____x3Cscript_javascript_alert(32)__script +'_____x00script_javascript_alert(33)__script +ABC_div_style=_x_x3Aexpression(javascript_alert(34)__DEF +ABC_div_style=_x_expression_x5C(javascript_alert(35)__DEF +ABC_div_style=_x_expression_x00(javascript_alert(36)__DEF +ABC_div_style=_x_exp_x00ression(javascript_alert(37)__DEF +ABC_div_style=_x_exp_x5Cression(javascript_alert(38)__DEF +ABC_div_style=_x__x0Aexpression(javascript_alert(39)__DEF +ABC_div_style=_x__x09expression(javascript_alert(40)__DEF +ABC_div_style=_x__xE3_x80_x80expression(javascript_alert(41)__DEF +ABC_div_style=_x__xE2_x80_x84expression(javascript_alert(42)__DEF +ABC_div_style=_x__xC2_xA0expression(javascript_alert(43)__DEF +ABC_div_style=_x__xE2_x80_x80expression(javascript_alert(44)__DEF +ABC_div_style=_x__xE2_x80_x8Aexpression(javascript_alert(45)__DEF +ABC_div_style=_x__x0Dexpression(javascript_alert(46)__DEF +ABC_div_style=_x__x0Cexpression(javascript_alert(47)__DEF +ABC_div_style=_x__xE2_x80_x87expression(javascript_alert(48)__DEF +ABC_div_style=_x__xEF_xBB_xBFexpression(javascript_alert(49)__DEF +ABC_div_style=_x__x20expression(javascript_alert(50)__DEF +ABC_div_style=_x__xE2_x80_x88expression(javascript_alert(51)__DEF +ABC_div_style=_x__x00expression(javascript_alert(52)__DEF +ABC_div_style=_x__xE2_x80_x8Bexpression(javascript_alert(53)__DEF +ABC_div_style=_x__xE2_x80_x86expression(javascript_alert(54)__DEF +ABC_div_style=_x__xE2_x80_x85expression(javascript_alert(55)__DEF +ABC_div_style=_x__xE2_x80_x82expression(javascript_alert(56)__DEF +ABC_div_style=_x__x0Bexpression(javascript_alert(57)__DEF +ABC_div_style=_x__xE2_x80_x81expression(javascript_alert(58)__DEF +ABC_div_style=_x__xE2_x80_x83expression(javascript_alert(59)__DEF +ABC_div_style=_x__xE2_x80_x89expression(javascript_alert(60)__DEF +a_href=__x0Bjavascript_javascript_alert(61)__id=_fuzzelement1__test__a +a_href=__x0Fjavascript_javascript_alert(62)__id=_fuzzelement1__test__a +a_href=__xC2_xA0javascript_javascript_alert(63)__id=_fuzzelement1__test__a +a_href=__x05javascript_javascript_alert(64)__id=_fuzzelement1__test__a +a_href=__xE1_xA0_x8Ejavascript_javascript_alert(65)__id=_fuzzelement1__test__a +a_href=__x18javascript_javascript_alert(66)__id=_fuzzelement1__test__a +a_href=__x11javascript_javascript_alert(67)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x88javascript_javascript_alert(68)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x89javascript_javascript_alert(69)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x80javascript_javascript_alert(70)__id=_fuzzelement1__test__a +a_href=__x17javascript_javascript_alert(71)__id=_fuzzelement1__test__a +a_href=__x03javascript_javascript_alert(72)__id=_fuzzelement1__test__a +a_href=__x0Ejavascript_javascript_alert(73)__id=_fuzzelement1__test__a +a_href=__x1Ajavascript_javascript_alert(74)__id=_fuzzelement1__test__a +a_href=__x00javascript_javascript_alert(75)__id=_fuzzelement1__test__a +a_href=__x10javascript_javascript_alert(76)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x82javascript_javascript_alert(77)__id=_fuzzelement1__test__a +a_href=__x20javascript_javascript_alert(78)__id=_fuzzelement1__test__a +a_href=__x13javascript_javascript_alert(79)__id=_fuzzelement1__test__a +a_href=__x09javascript_javascript_alert(80)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x8Ajavascript_javascript_alert(81)__id=_fuzzelement1__test__a +a_href=__x14javascript_javascript_alert(82)__id=_fuzzelement1__test__a +a_href=__x19javascript_javascript_alert(83)__id=_fuzzelement1__test__a +a_href=__xE2_x80_xAFjavascript_javascript_alert(84)__id=_fuzzelement1__test__a +a_href=__x1Fjavascript_javascript_alert(85)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x81javascript_javascript_alert(86)__id=_fuzzelement1__test__a +a_href=__x1Djavascript_javascript_alert(87)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x87javascript_javascript_alert(88)__id=_fuzzelement1__test__a +a_href=__x07javascript_javascript_alert(89)__id=_fuzzelement1__test__a +a_href=__xE1_x9A_x80javascript_javascript_alert(90)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x83javascript_javascript_alert(91)__id=_fuzzelement1__test__a +a_href=__x04javascript_javascript_alert(92)__id=_fuzzelement1__test__a +a_href=__x01javascript_javascript_alert(93)__id=_fuzzelement1__test__a +a_href=__x08javascript_javascript_alert(94)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x84javascript_javascript_alert(95)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x86javascript_javascript_alert(96)__id=_fuzzelement1__test__a +a_href=__xE3_x80_x80javascript_javascript_alert(97)__id=_fuzzelement1__test__a +a_href=__x12javascript_javascript_alert(98)__id=_fuzzelement1__test__a +a_href=__x0Djavascript_javascript_alert(99)__id=_fuzzelement1__test__a +a_href=__x0Ajavascript_javascript_alert(100)__id=_fuzzelement1__test__a +a_href=__x0Cjavascript_javascript_alert(101)__id=_fuzzelement1__test__a +a_href=__x15javascript_javascript_alert(102)__id=_fuzzelement1__test__a +a_href=__xE2_x80_xA8javascript_javascript_alert(103)__id=_fuzzelement1__test__a +a_href=__x16javascript_javascript_alert(104)__id=_fuzzelement1__test__a +a_href=__x02javascript_javascript_alert(105)__id=_fuzzelement1__test__a +a_href=__x1Bjavascript_javascript_alert(106)__id=_fuzzelement1__test__a +a_href=__x06javascript_javascript_alert(107)__id=_fuzzelement1__test__a +a_href=__xE2_x80_xA9javascript_javascript_alert(108)__id=_fuzzelement1__test__a +a_href=__xE2_x80_x85javascript_javascript_alert(109)__id=_fuzzelement1__test__a +a_href=__x1Ejavascript_javascript_alert(110)__id=_fuzzelement1__test__a +a_href=__xE2_x81_x9Fjavascript_javascript_alert(111)__id=_fuzzelement1__test__a +a_href=__x1Cjavascript_javascript_alert(112)__id=_fuzzelement1__test__a +a_href=_javascript_x00_javascript_alert(113)__id=_fuzzelement1__test__a +a_href=_javascript_x3A_javascript_alert(114)__id=_fuzzelement1__test__a +a_href=_javascript_x09_javascript_alert(115)__id=_fuzzelement1__test__a +a_href=_javascript_x0D_javascript_alert(116)__id=_fuzzelement1__test__a +a_href=_javascript_x0A_javascript_alert(117)__id=_fuzzelement1__test__a +'__img_src=xxx_x__x0Aonerror=javascript_alert(118) +'__img_src=xxx_x__x22onerror=javascript_alert(119) +'__img_src=xxx_x__x0Bonerror=javascript_alert(120) +'__img_src=xxx_x__x0Donerror=javascript_alert(121) +'__img_src=xxx_x__x2Fonerror=javascript_alert(122) +'__img_src=xxx_x__x09onerror=javascript_alert(123) +'__img_src=xxx_x__x0Conerror=javascript_alert(124) +'__img_src=xxx_x__x00onerror=javascript_alert(125) +'__img_src=xxx_x__x27onerror=javascript_alert(126) +'__img_src=xxx_x__x20onerror=javascript_alert(127) +'__script__x3Bjavascript_alert(128)__script +'__script__x0Djavascript_alert(129)__script +'__script__xEF_xBB_xBFjavascript_alert(130)__script +'__script__xE2_x80_x81javascript_alert(131)__script +'__script__xE2_x80_x84javascript_alert(132)__script +'__script__xE3_x80_x80javascript_alert(133)__script +'__script__x09javascript_alert(134)__script +'__script__xE2_x80_x89javascript_alert(135)__script +'__script__xE2_x80_x85javascript_alert(136)__script +'__script__xE2_x80_x88javascript_alert(137)__script +'__script__x00javascript_alert(138)__script +'__script__xE2_x80_xA8javascript_alert(139)__script +'__script__xE2_x80_x8Ajavascript_alert(140)__script +'__script__xE1_x9A_x80javascript_alert(141)__script +'__script__x0Cjavascript_alert(142)__script +'__script__x2Bjavascript_alert(143)__script +'__script__xF0_x90_x96_x9Ajavascript_alert(144)__script +'__script_-javascript_alert(145)__script +'__script__x0Ajavascript_alert(146)__script +'__script__xE2_x80_xAFjavascript_alert(147)__script +'__script__x7Ejavascript_alert(148)__script +'__script__xE2_x80_x87javascript_alert(149)__script +'__script__xE2_x81_x9Fjavascript_alert(150)__script +'__script__xE2_x80_xA9javascript_alert(151)__script +'__script__xC2_x85javascript_alert(152)__script +'__script__xEF_xBF_xAEjavascript_alert(153)__script +'__script__xE2_x80_x83javascript_alert(154)__script +'__script__xE2_x80_x8Bjavascript_alert(155)__script +'__script__xEF_xBF_xBEjavascript_alert(156)__script +'__script__xE2_x80_x80javascript_alert(157)__script +'__script__x21javascript_alert(158)__script +'__script__xE2_x80_x82javascript_alert(159)__script +'__script__xE2_x80_x86javascript_alert(160)__script +'__script__xE1_xA0_x8Ejavascript_alert(161)__script +'__script__x0Bjavascript_alert(162)__script +'__script__x20javascript_alert(163)__script +'__script__xC2_xA0javascript_alert(164)__script +img__x00src=x_onerror=_alert(165) +img__x47src=x_onerror=_javascript_alert(166) +img__x11src=x_onerror=_javascript_alert(167) +img__x12src=x_onerror=_javascript_alert(168) +img_x47src=x_onerror=_javascript_alert(169) +img_x10src=x_onerror=_javascript_alert(170) +img_x13src=x_onerror=_javascript_alert(171) +img_x32src=x_onerror=_javascript_alert(172) +img_x47src=x_onerror=_javascript_alert(173) +img_x11src=x_onerror=_javascript_alert(174) +img__x47src=x_onerror=_javascript_alert(175) +img__x34src=x_onerror=_javascript_alert(176) +img__x39src=x_onerror=_javascript_alert(177) +img__x00src=x_onerror=_javascript_alert(178) +img_src_x09=x_onerror=_javascript_alert(179) +img_src_x10=x_onerror=_javascript_alert(180) +img_src_x13=x_onerror=_javascript_alert(181) +img_src_x32=x_onerror=_javascript_alert(182) +img_src_x12=x_onerror=_javascript_alert(183) +img_src_x11=x_onerror=_javascript_alert(184) +img_src_x00=x_onerror=_javascript_alert(185) +img_src_x47=x_onerror=_javascript_alert(186) +img_src=x_x09onerror=_javascript_alert(187) +img_src=x_x10onerror=_javascript_alert(188) +img_src=x_x11onerror=_javascript_alert(189) +img_src=x_x12onerror=_javascript_alert(190) +img_src=x_x13onerror=_javascript_alert(191) +img_a__b__c_src_d_=x_e_onerror=_f__alert(192) +img_src=x_onerror=_x09_javascript_alert(193) +img_src=x_onerror=_x10_javascript_alert(194) +img_src=x_onerror=_x11_javascript_alert(195) +img_src=x_onerror=_x12_javascript_alert(196) +img_src=x_onerror=_x32_javascript_alert(197) +img_src=x_onerror=_x00_javascript_alert(198) +a_href=java__1__2__3__4__5__6__7__8__11__12script_javascript_alert(199)_XXX__a +img_src=_x____script_javascript_alert(200)__script +img_src_onerror____'_=_alt=javascript_alert(201) +title_onpropertychange=javascript_alert(202)___title__title_title= +a_href=http___foo.bar__x=_y___a__img_alt=____img_src=x_x_onerror=javascript_alert(203)___a +!--_if___script_javascript_alert(204)__script +!--_if_img_src=x_onerror=javascript_alert(205) +script_src=____(jscript)s____script +script_src=____(jscript)s____script +IMG______SCRIPT_alert(_206_)__SCRIPT +IMG_SRC=javascript_alert(String.fromCharCode(50,48,55)) +IMG_SRC=__onmouseover=_alert('208') +IMG_SRC=_onmouseover=_alert('209') +IMG_onmouseover=_alert('210') +IMG_SRC=__106;__97;__118;__97;__115;__99;__114;__105;__112;__116;__58;__97;__108;__101;__114;__116;__40;__39;__50;__49;__49;__39;__41 +IMG_SRC=__0000106__0000097__0000118__0000097__0000115__0000099__0000114__0000105__0000112__0000116__0000058__0000097__0000108__0000101__0000114__0000116__0000040__0000039__0000050__0000049__0000050__0000039__0000041 +IMG_SRC=__x6A__x61__x76__x61__x73__x63__x72__x69__x70__x74__x3A__x61__x6C__x65__x72__x74__x28__x27__x32__x31__x33__x27__x29 +IMG_SRC=_jav___ascript_alert('214') +IMG_SRC=_jav__x09;ascript_alert('215') +IMG_SRC=_jav__x0A;ascript_alert('216') +IMG_SRC=_jav__x0D;ascript_alert('217') +perl_-e_'print___IMG_SRC=java_0script_alert(__218__)__;'___out +IMG_SRC=____14;__javascript_alert('219') +SCRIPT_XSS_SRC=_http___ha.ckers.org_xss.js____SCRIPT +BODY_onload!_$__()_~+.@_______=alert(_220_) +SCRIPT_SRC=_http___ha.ckers.org_xss.js____SCRIPT +SCRIPT_alert(_221_);_____SCRIPT +SCRIPT_SRC=http___ha.ckers.org_xss.js___B +SCRIPT_SRC=__ha.ckers.org.j +IMG_SRC=_javascript_alert('222') +iframe_src=http___ha.ckers.org_scriptlet.html +alert('223') +u_oncopy=alert()__Copy_me__u +i_onwheel=alert(224)__Scroll_over_me___i +plaintext +http___a___30_30 +textarea__script_alert(225)__script +_ +SQL_Injection +_ +Strings_which_can_cause_a_SQL_injection_if_inputs_are_not_sanitized +_ +1;DROP_TABLE_users +1';_DROP_TABLE_users--_1 +'_OR_1=1_--_1 +'_OR_'1'='1 +';_EXEC_sp_MSForEachTable_'DROP_TABLE__' +_ +_ +_ +_ +Server_Code_Injection +_ +Strings_which_can_cause_user_to_run_code_on_server_as_a_privileged_user_(c.f._https___news.ycombinator.com_item_id=7665153) +_ +_ +_ +version +help +$USER +dev_null;_touch__tmp_blns.fail_;_echo +touch__tmp_blns.fail +$(touch__tmp_blns.fail) +@__system__touch__tmp_blns.fail +_ +Command_Injection_(Ruby) +_ +Strings_which_can_call_system_commands_within_Ruby_Rails_applications +_ +eval(_puts_'hello_world'_) +System(_ls_-al___) +ls_-al +Kernel.exec(_ls_-al___) +Kernel.exit(1) +x('ls_-al__') +_ +XXE_Injection_(XML) +_ +String_which_can_reveal_system_files_when_parsed_by_a_badly_configured_XML_parser +_ +xml_version=_1.0__encoding=_ISO-8859-1____!DOCTYPE_foo____!ELEMENT_foo_ANY___!ENTITY_xxe_SYSTEM__file____etc_passwd______foo__xxe;__foo +_ +Unwanted_Interpolation +_ +Strings_which_can_be_accidentally_expanded_into_different_strings_if_evaluated_in_the_wrong_context,_e.g._used_as_a_printf_format_string_or_via_Perl_or_shell_eval._Might_expose_sensitive_data_from_the_program_doing_the_interpolation,_or_might_just_repres. +_ +$HOME +$ENV_'HOME' +d +s_s_s_s_s +0 +.s +@ +n +File +_ +File_Inclusion +_ +Strings_which_can_cause_user_to_pull_in_files_that_should_not_be_a_part_of_a_web_server +_ +.etc_passwd_00 +.etc_hosts +_ +Known_CVEs_and_Vulnerabilities +_ +Strings_that_test_for_known_vulnerabilities +_ +()___0;__;_touch__tmp_blns.shellshock1.fail +()____;______$($())____touch__tmp_blns.shellshock2.fail +s(un='_s')_=__u ++++ATH0 +_ +MSDOS_Windows_Special_Filenames +_ +Strings_which_are_reserved_characters_in_MSDOS_Windows +_ +CON_ +PRN_ +AUX_ +CLOCK$ +NUL_ +A +ZZ +COM1_ +LPT1_ +LPT2_ +LPT3_ +COM2_ +COM3_ +COM4_ +_ +IRC_specific_strings +_ +Strings_that_may_occur_on_IRC_clients_that_make_security_products_freak_out +_ +DCC_SEND_STARTKEYLOGGER_0_0_0 +_ +Scunthorpe_Problem +_ +Innocuous_strings_which_may_be_blocked_by_profanity_filters_(https___en.wikipedia.org_wiki_Scunthorpe_problem) +_ +Scunthorpe_General_Hospital +Penistone_Community_Church +Lightwater_Country_Park +Jimmy_Clitheroe +Horniman_Museum +shitake_mushrooms +RomansInSussex.co.uk +http___www.cum.qc.ca +Craig_Cockburn,_Software_Specialist +Linda_Callahan +Dr._Herman_I.Libshitz +magna_cum_laude +Super_Bowl_XXX +medieval_erection_of_parapets +evaluate +mocha +expression +Arsenal_canal +classic +Tyson_Gay +Dick_Van_Dyke +basement +_ +Human_injection +_ +Strings_which_may_cause_human_to_reinterpret_worldview +_ +If_you're_reading_this,_you've_been_in_a_coma_for_almost_20_years_now._We're_trying_a_new_technique._We_don't_know_where_this_message_will_end_up_in_your_dream,_but_we_hope_it_works._Please_wake_up,_we_miss_you. +_ +Terminal_escape_codes +_ +Strings_which_punish_the_fools_who_use_cat_type_on_this_file +_ +Roses_are___0;31mred__0m,_violets_are___0;34mblue.Hope_you_enjoy_terminal_hue +But_now...__20Cfor_my_greatest_trick.8m +The_quic______k_brown_fo___________x.Beeeep +_ +iOS_Vulnerabilities +_ +Strings_which_crashed_iMessage_in_various_versions_of_iOS +_ +Powerلُلُصّبُلُلصّبُررً_ॣ_ॣh_ॣ_ॣ冗 +🏳0🌈️ +జ్ఞ‌ా +_ +Persian_special_characters +_ +This_is_a_four_characters_string_which_includes_Persian_special_characters_(گچپژ) +_ +گچپژ +_ +jinja2_injection +_ +first_one_is_supposed_to_raise__MemoryError__exception +second,_obviously,_prints_contents_of__etc_passwd +_ +print_'x'___64___1024__3 +class__.__mro___2_.__subclasses__()_40_(__etc_passwd_).read() diff --git a/tests/misc.default.capacity b/tests/misc.default.capacity new file mode 100644 index 0000000..d9623a5 --- /dev/null +++ b/tests/misc.default.capacity @@ -0,0 +1,53 @@ +49 +2 +12 +52 +50 +266 +41 +7 +37 +35 +41 +1 +2 +4 +5 +13 +20 +46 +37 +1 +287 +23 +505 +490 +282 +23 +505 +504 +496 +488 +264 +25 +505 +493 +286 +24 +505 +480 +312 +1 +11 +11 +11 +12 +12 +4 +6 +9 +4 +5 +12 +1 +257 diff --git a/tests/misc.default.sanitised b/tests/misc.default.sanitised new file mode 100644 index 0000000..0c0a6b6 --- /dev/null +++ b/tests/misc.default.sanitised @@ -0,0 +1,53 @@ +These are miscellaneous tests of my own division. +_ +hello_world +The quick brown fox jumps over the lazy doggerel.txt +well _ then.how about this +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its grandf.“If a wolf should come out of the forest, then what would you do_” +(Some Peter and the Wolf snuck in there.) +.hidden +C__WINDOWS_system32_driver_etc_hosts +%WINDIR%_system32_driver_etc_hosts +Kinda funny how Windows has a _etc_hosts. +_ +_ +_ +_ +_ +_ +I’m basically just typing random stuff here. +OK, time for some more serious stuff. +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances_ UTF-16 uses one code unit until U+FFF.Now then_ one-byte characters +# One-byte characters +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +# Two-byte characters +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +# Three-byte characters +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +# Four-byte characters +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX_.abcdef +lpT7_.abcdef +cOm6_.abcdef +CON_ +aux_.h +Lpt1_.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ (.) diff --git a/tests/misc.just-most_fs_safe.capacity b/tests/misc.just-most_fs_safe.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.just-most_fs_safe.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.just-most_fs_safe.sanitised b/tests/misc.just-most_fs_safe.sanitised new file mode 100644 index 0000000..ba68401 --- /dev/null +++ b/tests/misc.just-most_fs_safe.sanitised @@ -0,0 +1,53 @@ +These are miscellaneous tests of my own division. +_ +hello_world +The quick brown fox jumps over the lazy doggerel.txt + well ? then . how about this ? +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its grand. “If a wolf should come out of the forest, then what would you do?” +(Some Peter and the Wolf snuck in there.) +.hidden +C:\WINDOWS\system32\driver\etc\hosts +%WINDIR%\system32\driver\etc\hosts +Kinda funny how Windows has a _etc_hosts. +_ +_ +_ +_ +_._._._._._._ + . .. . . . .. .. +I’m basically just typing random stuff here. +OK, time for some more serious stuff. +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances: UTF-16 uses one code unit until U+F. Now then: one-byte characters: +# One-byte characters: +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +# Two-byte characters: +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ. +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +# Three-byte characters: +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +# Four-byte characters: +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂. +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX.abcdef +lpT7.abcdef +cOm6.abcdef +CON +aux.h +Lpt1.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ (.) diff --git a/tests/misc.just-normalise_whitespace.capacity b/tests/misc.just-normalise_whitespace.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.just-normalise_whitespace.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.just-normalise_whitespace.sanitised b/tests/misc.just-normalise_whitespace.sanitised new file mode 100644 index 0000000..376db0d Binary files /dev/null and b/tests/misc.just-normalise_whitespace.sanitised differ diff --git a/tests/misc.just-remove_control_characters.capacity b/tests/misc.just-remove_control_characters.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.just-remove_control_characters.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.just-remove_control_characters.sanitised b/tests/misc.just-remove_control_characters.sanitised new file mode 100644 index 0000000..b995c6e --- /dev/null +++ b/tests/misc.just-remove_control_characters.sanitised @@ -0,0 +1,53 @@ +These are miscellaneous tests of my own division. +_ +hello_world +The quick brown fox jumps over the lazy doggerel.txt + well ? then _ . __ how about this ? +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its grand. “If a wolf should come out of the forest, then what would you do?” +(Some Peter and the Wolf snuck in there.) +.hidden +C:\WINDOWS\system32\driver\etc\hosts +%WINDIR%\system32\driver\etc\hosts +Kinda funny how Windows has a /etc/hosts. +. +.. +... +.... +/././././././ + . .. . . . .. .. +I’m basically just typing random stuff here. +OK, time for some more serious stuff. +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances: UTF-16 uses one code unit until U+F. Now then: one-byte characters: +# One-byte characters: +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +# Two-byte characters: +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ. +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +# Three-byte characters: +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +# Four-byte characters: +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂. +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX.abcdef +lpT7.abcdef +cOm6.abcdef +CON +aux.h +Lpt1.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ (.) diff --git a/tests/misc.just-remove_reordering_characters.capacity b/tests/misc.just-remove_reordering_characters.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.just-remove_reordering_characters.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.just-remove_reordering_characters.sanitised b/tests/misc.just-remove_reordering_characters.sanitised new file mode 100644 index 0000000..e603bbf Binary files /dev/null and b/tests/misc.just-remove_reordering_characters.sanitised differ diff --git a/tests/misc.just-trim_more_punctuation.capacity b/tests/misc.just-trim_more_punctuation.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.just-trim_more_punctuation.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.just-trim_more_punctuation.sanitised b/tests/misc.just-trim_more_punctuation.sanitised new file mode 100644 index 0000000..e603bbf Binary files /dev/null and b/tests/misc.just-trim_more_punctuation.sanitised differ diff --git a/tests/misc.just-trim_spaces_and_full_stops.capacity b/tests/misc.just-trim_spaces_and_full_stops.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.just-trim_spaces_and_full_stops.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.just-trim_spaces_and_full_stops.sanitised b/tests/misc.just-trim_spaces_and_full_stops.sanitised new file mode 100644 index 0000000..c820247 Binary files /dev/null and b/tests/misc.just-trim_spaces_and_full_stops.sanitised differ diff --git a/tests/misc.just-url_safe.capacity b/tests/misc.just-url_safe.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.just-url_safe.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.just-url_safe.sanitised b/tests/misc.just-url_safe.sanitised new file mode 100644 index 0000000..8e8604d --- /dev/null +++ b/tests/misc.just-url_safe.sanitised @@ -0,0 +1,53 @@ +These_are_miscellaneous_tests_of_my_own_division. +_ +hello_world +The_quick_brown_fox_jumps_over_the_lazy_doggerel.txt +___well_____then_____.____how__about_____this_____ +Once_upon_a_time_there_was_a_file_name_sanitiser;_it_was_a_good_file_name_sanitiser,_and_never_exposed_security_vulnerabilities_to_the_World._“It’s_a_dangerous_place,”_its_grand._“If_a_wolf_should_come_out_of_the_forest,_then_what_would_you_do_” +(Some_Peter_and_the_Wolf_snuck_in_there.) +.hidden +C:_WINDOWS_system32_driver_etc_hosts +_WINDIR__system32_driver_etc_hosts +Kinda_funny_how_Windows_has_a__etc_hosts. +_ +_ +... +.... +_._._._._._._ +__._.._._._._..__.._ +I’m_basically_just_typing_random_stuff_here. +OK,_time_for_some_more_serious_stuff. +_ +For_Unicode_paths,_some_file_systems_limit_paths_to_roughly_255_UTF-8_code_units,_others_to_roughly_255_UTF-16_code_units._UTF-8_is_the_tighter_of_these_restrictions_in_all_circumstances:_UTF-16_uses_one_code_unit_until_U+F._Now_then:_one-byte_characters: +__One-byte_characters: +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +__Two-byte_characters: +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ. +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +__Three-byte_characters: +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +__Four-byte_characters: +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂. +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX.abcdef +lpT7.abcdef +cOm6.abcdef +CON +aux.h +Lpt1.exe +xyz +nül +COM1.jpg.png +_ +Some_sanitisers_try_stripping_out_ZWSP_(​),_which_can_be_used_as_a_fingerprinting_vector_and_has_no_particularly_legitimate_purpose_in_a_file_name;_I’m_not,_because_removing_it_doesn’t_solve_the_fingerprinting_risk,_as_you_can_use_ZWNJ_and_ZWJ_(.) diff --git a/tests/misc.just-windows_safe.capacity b/tests/misc.just-windows_safe.capacity new file mode 100644 index 0000000..d9623a5 --- /dev/null +++ b/tests/misc.just-windows_safe.capacity @@ -0,0 +1,53 @@ +49 +2 +12 +52 +50 +266 +41 +7 +37 +35 +41 +1 +2 +4 +5 +13 +20 +46 +37 +1 +287 +23 +505 +490 +282 +23 +505 +504 +496 +488 +264 +25 +505 +493 +286 +24 +505 +480 +312 +1 +11 +11 +11 +12 +12 +4 +6 +9 +4 +5 +12 +1 +257 diff --git a/tests/misc.just-windows_safe.sanitised b/tests/misc.just-windows_safe.sanitised new file mode 100644 index 0000000..9dab611 --- /dev/null +++ b/tests/misc.just-windows_safe.sanitised @@ -0,0 +1,53 @@ +These are miscellaneous tests of my own division. +_ +hello_world +The quick brown fox jumps over the lazy doggerel.txt + well _ then _ . __ how about this _ +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its grand. “If a wolf should come out of the forest, then what would you do_” +(Some Peter and the Wolf snuck in there.) +.hidden +C__WINDOWS_system32_driver_etc_hosts +%WINDIR%_system32_driver_etc_hosts +Kinda funny how Windows has a _etc_hosts. +. +.. +... +.... +_._._._._._._ +_ +I’m basically just typing random stuff here. +OK, time for some more serious stuff. +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances_ UTF-16 uses one code unit until U+F. Now then_ one-byte characters_ +# One-byte characters_ +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +# Two-byte characters_ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +# Three-byte characters_ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +# Four-byte characters_ +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX_.abcdef +lpT7_.abcdef +cOm6_.abcdef +CON_ +aux_.h +Lpt1_.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ (.) diff --git a/tests/misc.no-extension_cleverness.capacity b/tests/misc.no-extension_cleverness.capacity new file mode 100644 index 0000000..a420ea1 --- /dev/null +++ b/tests/misc.no-extension_cleverness.capacity @@ -0,0 +1,53 @@ +50 +2 +12 +53 +51 +256 +42 +8 +37 +35 +42 +2 +3 +4 +5 +14 +21 +47 +38 +1 +256 +23 +256 +256 +256 +23 +256 +256 +256 +256 +256 +25 +256 +256 +256 +24 +256 +256 +256 +1 +12 +12 +11 +12 +12 +4 +6 +9 +4 +5 +13 +1 +256 diff --git a/tests/misc.no-extension_cleverness.sanitised b/tests/misc.no-extension_cleverness.sanitised new file mode 100644 index 0000000..65fc1b2 --- /dev/null +++ b/tests/misc.no-extension_cleverness.sanitised @@ -0,0 +1,53 @@ +These are miscellaneous tests of my own division +_ +hello_world +The quick brown fox jumps over the lazy doggerel.txt +well _ then . how about this +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its grandfather said. “If a wolf should come out of the forest, then what would +(Some Peter and the Wolf snuck in there.) +hidden +C__WINDOWS_system32_driver_etc_hosts +%WINDIR%_system32_driver_etc_hosts +Kinda funny how Windows has a _etc_hosts +_ +_ +_ +_ +_ +_ +I’m basically just typing random stuff here +OK, time for some more serious stuff +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances_ UTF-16 uses one code unit until U+FFFF, and two beyond that, while +# One-byte characters +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +# Two-byte characters +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +# Three-byte characters +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +# Four-byte characters +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +_ +abcdef.ghij +abcde.fghij +AUX.abcdef +lpT7.abcdef +cOm6.abcdef +CON_ +aux.h +Lpt1.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ (‌ diff --git a/tests/misc.no-windows_safe.capacity b/tests/misc.no-windows_safe.capacity new file mode 100644 index 0000000..c87dd04 --- /dev/null +++ b/tests/misc.no-windows_safe.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +1 +287 +22 +505 +490 +282 +22 +505 +504 +496 +488 +264 +24 +505 +493 +286 +23 +505 +480 +312 +1 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +1 +257 diff --git a/tests/misc.no-windows_safe.sanitised b/tests/misc.no-windows_safe.sanitised new file mode 100644 index 0000000..926c504 --- /dev/null +++ b/tests/misc.no-windows_safe.sanitised @@ -0,0 +1,53 @@ +These are miscellaneous tests of my own division. +_ +hello_world +The quick brown fox jumps over the lazy doggerel.txt +well ? then.how about this ? +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its grandf.“If a wolf should come out of the forest, then what would you do?” +(Some Peter and the Wolf snuck in there.) +.hidden +C:\WINDOWS\system32\driver\etc\hosts +%WINDIR%\system32\driver\etc\hosts +Kinda funny how Windows has a _etc_hosts. +_ +_ +_ +_ +_ +_ +I’m basically just typing random stuff here. +OK, time for some more serious stuff. +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances: UTF-16 uses one code unit until U+FF.Now then: one-byte characters: +# One-byte characters: +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +# Two-byte characters: +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +# Three-byte characters: +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +# Four-byte characters: +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX.abcdef +lpT7.abcdef +cOm6.abcdef +CON +aux.h +Lpt1.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ (.) diff --git a/tests/misc.passthrough.capacity b/tests/misc.passthrough.capacity new file mode 100644 index 0000000..9e11326 --- /dev/null +++ b/tests/misc.passthrough.capacity @@ -0,0 +1,53 @@ +49 +1 +11 +52 +50 +266 +41 +7 +36 +34 +41 +1 +2 +3 +4 +13 +20 +46 +37 +0 +543 +22 +521 +495 +287 +22 +517 +509 +501 +493 +269 +24 +559 +526 +319 +23 +577 +521 +353 +0 +11 +11 +10 +11 +11 +3 +5 +8 +3 +4 +12 +0 +620 diff --git a/tests/misc.passthrough.sanitised b/tests/misc.passthrough.sanitised new file mode 100644 index 0000000..b50fa8b Binary files /dev/null and b/tests/misc.passthrough.sanitised differ diff --git a/tests/misc.realistic-length_limit-reduction.capacity b/tests/misc.realistic-length_limit-reduction.capacity new file mode 100644 index 0000000..22a1304 --- /dev/null +++ b/tests/misc.realistic-length_limit-reduction.capacity @@ -0,0 +1,53 @@ +49 +2 +12 +52 +50 +266 +41 +7 +37 +35 +41 +1 +2 +4 +5 +13 +20 +46 +37 +1 +283 +23 +497 +486 +278 +23 +497 +497 +492 +484 +260 +25 +497 +489 +282 +24 +497 +476 +308 +1 +11 +11 +11 +12 +12 +4 +6 +9 +4 +5 +12 +1 +253 diff --git a/tests/misc.realistic-length_limit-reduction.sanitised b/tests/misc.realistic-length_limit-reduction.sanitised new file mode 100644 index 0000000..2b6a612 --- /dev/null +++ b/tests/misc.realistic-length_limit-reduction.sanitised @@ -0,0 +1,53 @@ +These are miscellaneous tests of my own division. +_ +hello_world +The quick brown fox jumps over the lazy doggerel.txt +well _ then.how about this +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its gr.“If a wolf should come out of the forest, then what would you do_” +(Some Peter and the Wolf snuck in there.) +.hidden +C__WINDOWS_system32_driver_etc_hosts +%WINDIR%_system32_driver_etc_hosts +Kinda funny how Windows has a _etc_hosts. +_ +_ +_ +_ +_ +_ +I’m basically just typing random stuff here. +OK, time for some more serious stuff. +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances_ UTF-16 uses one code unit until U.Now then_ one-byte characters +# One-byte characters +12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901 +1234567890123456.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +12345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234.abcdefghijklmnopqrstuvwxyz +# Two-byte characters +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđé +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđé +áɓçđé.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦï.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķá.°¹²³ +# Three-byte characters +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚ +‐‑‒–.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐.₁₂₃₄₅₆₇₈₉₀ +# Four-byte characters +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁 +𐀀𐀁𐀂𐀃𐀄𐀅.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX_.abcdef +lpT7_.abcdef +cOm6_.abcdef +CON_ +aux_.h +Lpt1_.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ.) diff --git a/tests/misc.short-sans-extension_cleverness.capacity b/tests/misc.short-sans-extension_cleverness.capacity new file mode 100644 index 0000000..2696474 --- /dev/null +++ b/tests/misc.short-sans-extension_cleverness.capacity @@ -0,0 +1,53 @@ +11 +2 +11 +11 +11 +11 +11 +8 +11 +11 +11 +2 +3 +4 +5 +11 +11 +11 +11 +1 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +11 +1 +11 +11 +11 +11 +11 +4 +6 +9 +4 +5 +11 +1 +11 diff --git a/tests/misc.short-sans-extension_cleverness.sanitised b/tests/misc.short-sans-extension_cleverness.sanitised new file mode 100644 index 0000000..41ed238 --- /dev/null +++ b/tests/misc.short-sans-extension_cleverness.sanitised @@ -0,0 +1,53 @@ +These are +_ +hello_worl +The quick +well _ the +Once upon +(Some Pete +hidden +C__WINDOWS +%WINDIR%_s +Kinda funn +_ +_ +_ +_ +_ +_ +I’m basi +OK, time f +_ +For Unicod +# One-byte +1234567890 +1234567890 +1234567890 +# Two-byte +áɓçđé +áɓçđé +áɓçđé +áɓçđé +áɓçđé +# Three-by +‐‑‒ +‐‑‒ +‐‑‒ +# Four-byt +𐀀𐀁 +𐀀𐀁 +𐀀𐀁 +_ +abcdef.ghi +abcde.fghi +AUX.abcdef +lpT7.abcde +cOm6.abcde +CON_ +aux.h +Lpt1.exe +xyz +nül +COM1.jpg.p +_ +Some sanit diff --git a/tests/misc.short.capacity b/tests/misc.short.capacity new file mode 100644 index 0000000..864a019 --- /dev/null +++ b/tests/misc.short.capacity @@ -0,0 +1,53 @@ +11 +2 +11 +14 +15 +15 +12 +7 +11 +11 +11 +1 +2 +4 +5 +12 +12 +11 +11 +1 +15 +11 +15 +15 +15 +11 +15 +15 +15 +15 +15 +11 +15 +15 +15 +11 +15 +15 +15 +1 +11 +10 +10 +10 +10 +4 +6 +9 +4 +5 +12 +1 +12 diff --git a/tests/misc.short.sanitised b/tests/misc.short.sanitised new file mode 100644 index 0000000..6de4edb --- /dev/null +++ b/tests/misc.short.sanitised @@ -0,0 +1,53 @@ +These are. +_ +hello_worl +The qu.txt +well _ the +Once upon +(Some Pe.) +.hidd +C__WINDOWS +%WINDIR%_s +Kinda fun. +_ +_ +_ +_ +_ +_ +I’m bas. +OK, time. +_ +For Unicod +# One-byte +1234567890 +1234567890 +1234567890 +# Two-byte +áɓçđé +áɓçđé +áɓçđé +áɓçđé +áɓçđé +# Three-by +‐‑‒ +‐‑‒ +‐‑‒ +# Four-byt +𐀀𐀁 +𐀀𐀁 +𐀀𐀁 +_ +abcde.ghij +abcde.fghi +AUX_.abcd +lpT7_.abcd +cOm6_.abcd +CON_ +aux_.h +Lpt1_.exe +xyz +nül +COM1.j.png +_ +Some san.) diff --git a/tests/misc.silly-replace_with.capacity b/tests/misc.silly-replace_with.capacity new file mode 100644 index 0000000..d9623a5 --- /dev/null +++ b/tests/misc.silly-replace_with.capacity @@ -0,0 +1,53 @@ +49 +2 +12 +52 +50 +266 +41 +7 +37 +35 +41 +1 +2 +4 +5 +13 +20 +46 +37 +1 +287 +23 +505 +490 +282 +23 +505 +504 +496 +488 +264 +25 +505 +493 +286 +24 +505 +480 +312 +1 +11 +11 +11 +12 +12 +4 +6 +9 +4 +5 +12 +1 +257 diff --git a/tests/misc.silly-replace_with.sanitised b/tests/misc.silly-replace_with.sanitised new file mode 100644 index 0000000..00014dd --- /dev/null +++ b/tests/misc.silly-replace_with.sanitised @@ -0,0 +1,57 @@ +These are miscellaneous tests of my own division. + +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ + +helloworld +⚠ Sanitisation did not reach a steady state. Next line shows the effect of resanitising the line above. ⚠ +helloworld +The quick brown fox jumps over the lazy doggerel.txt +well @ then.how about this @ +Once upon a time there was a file name sanitiser; it was a good file name sanitiser, and never exposed security vulnerabilities to the World. “It’s a dangerous place,” its grandf.“If a wolf should come out of the forest, then what would you do@” +(Some Peter and the Wolf snuck in there.) +.hidden +C;]WINDOWS]system32]driver]etc]hosts +%WINDIR%]system32]driver]etc]hosts +Kinda funny how Windows has a 0etc0hosts. +_ +_ +_ +_ +0.0.0.0.0.0.0 +_ +I’m basically just typing random stuff here. +OK, time for some more serious stuff. +_ +For Unicode paths, some file systems limit paths to roughly 255 UTF-8 code units, others to roughly 255 UTF-16 code units. UTF-8 is the tighter of these restrictions in all circumstances; UTF-16 uses one code unit until U+FFF.Now then; one-byte characters +# One-byte characters +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +# Two-byte characters +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +# Three-byte characters +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +# Four-byte characters +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX_.abcdef +lpT7_.abcdef +cOm6_.abcdef +CON_ +aux_.h +Lpt1_.exe +xyz +nül +COM1.jpg.png +_ +Some sanitisers try stripping out ZWSP (​), which can be used as a fingerprinting vector and has no particularly legitimate purpose in a file name; I’m not, because removing it doesn’t solve the fingerprinting risk, as you can use ZWNJ and ZWJ (.) diff --git a/tests/misc.txt b/tests/misc.txt new file mode 100644 index 0000000..b50fa8b Binary files /dev/null and b/tests/misc.txt differ diff --git a/tests/misc.url_safe.capacity b/tests/misc.url_safe.capacity new file mode 100644 index 0000000..d9623a5 --- /dev/null +++ b/tests/misc.url_safe.capacity @@ -0,0 +1,53 @@ +49 +2 +12 +52 +50 +266 +41 +7 +37 +35 +41 +1 +2 +4 +5 +13 +20 +46 +37 +1 +287 +23 +505 +490 +282 +23 +505 +504 +496 +488 +264 +25 +505 +493 +286 +24 +505 +480 +312 +1 +11 +11 +11 +12 +12 +4 +6 +9 +4 +5 +12 +1 +257 diff --git a/tests/misc.url_safe.sanitised b/tests/misc.url_safe.sanitised new file mode 100644 index 0000000..616f965 --- /dev/null +++ b/tests/misc.url_safe.sanitised @@ -0,0 +1,53 @@ +These_are_miscellaneous_tests_of_my_own_division. +_ +hello_world +The_quick_brown_fox_jumps_over_the_lazy_doggerel.txt +well_____then.how__about_____this +Once_upon_a_time_there_was_a_file_name_sanitiser;_it_was_a_good_file_name_sanitiser,_and_never_exposed_security_vulnerabilities_to_the_World._“It’s_a_dangerous_place,”_its_grandf.“If_a_wolf_should_come_out_of_the_forest,_then_what_would_you_do_” +(Some_Peter_and_the_Wolf_snuck_in_there.) +.hidden +C__WINDOWS_system32_driver_etc_hosts +WINDIR__system32_driver_etc_hosts +Kinda_funny_how_Windows_has_a__etc_hosts. +_ +_ +_ +_ +_ +_ +I’m_basically_just_typing_random_stuff_here. +OK,_time_for_some_more_serious_stuff. +_ +For_Unicode_paths,_some_file_systems_limit_paths_to_roughly_255_UTF-8_code_units,_others_to_roughly_255_UTF-16_code_units._UTF-8_is_the_tighter_of_these_restrictions_in_all_circumstances__UTF-16_uses_one_code_unit_until_U+FFF.Now_then__one-byte_characters +One-byte_characters +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 +12345678901234567890.abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz +123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678.abcdefghijklmnopqrstuvwxyz +Two-byte_characters +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠ +áɓç.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠ.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķá.°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³°¹²³ +áɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓçđéƒɠɦïķáɓç.°¹²³ +Three-byte_characters +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“ +‐‑‒–—.₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉₀₁₂₃₄₅₆₇₈₉ +‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑‒–—―‖‗‘’‚‛“”„‟†‡•‣․‥…‧‐‑.₁₂₃₄₅₆₇₈₉₀ +Four-byte_characters +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲𐀳𐀴𐀵𐀶𐀷𐀸𐀹𐀺𐀼𐀽𐀿𐁀𐁁𐁂 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +𐀀𐀁𐀂𐀃𐀄𐀅𐀆𐀇𐀈𐀉𐀊𐀋𐀍𐀎𐀏𐀐𐀑𐀒𐀓𐀔𐀕𐀖𐀗𐀘𐀙𐀚𐀛𐀜𐀝𐀞𐀟𐀠𐀡𐀢𐀣𐀤𐀥𐀦𐀨𐀩𐀪𐀫𐀬𐀭𐀮𐀯𐀰𐀱𐀲.𐂀𐂁𐂂𐂃𐂄𐂅𐂆𐂇𐂈𐂉𐂊𐂋𐂌𐂍 +_ +abcdef.ghij +abcde.fghij +AUX_.abcdef +lpT7_.abcdef +cOm6_.abcdef +CON_ +aux_.h +Lpt1_.exe +xyz +nül +COM1.jpg.png +_ +Some_sanitisers_try_stripping_out_ZWSP_(​),_which_can_be_used_as_a_fingerprinting_vector_and_has_no_particularly_legitimate_purpose_in_a_file_name;_I’m_not,_because_removing_it_doesn’t_solve_the_fingerprinting_risk,_as_you_can_use_ZWNJ_and_ZWJ_(.)