Pope Unicode I

Encyclical

"Per Punctum Punctum Ascendo". The new millennium opened with a URL: type "..%c0%af" and IIS 4 and 5 climbed the stairs all the way to cmd.exe. One creatively encoded character was enough to fool the path checks, and the sadmind/IIS and Nimda worms turned it into a motorway. The lesson: canonicalise first, check second, never the other way round.

Saint page: Saint IIS Unicode Traversal

Cardinals

wu-ftpd SITE EXEC format string (Ramen worm)