Fuzz中的javascript大小写特性

phith0n (我也不会难过你不要小看我) | 2014-09-25 00:17

@瞌睡龍说发过来，我就发到zone里给大家一起分享吧~

toUpperCase()是javascript中将小写转换成大写的函数。toLowerCase()是javascript中将大写转换成小写的函数。但是这俩函数真的只有这两个功能么？

不如我们来fuzz一下，看看toUpperCase功能如何？

if (!String.fromCodePoint) {
  (function() {
    var defineProperty = (function() {
      // IE 8 only supports `Object.defineProperty` on DOM elements
      try {
        var object = {};
        var $defineProperty = Object.defineProperty;
        var result = $defineProperty(object, object, object) && $defineProperty;
       } catch(error) {}
      return result;
    }());
    var stringFromCharCode = String.fromCharCode;
    var floor = Math.floor;
    var fromCodePoint = function() {
      var MAX_SIZE = 0x4000;
      var codeUnits = [];
      var highSurrogate;
      var lowSurrogate;
      var index = -1;
      var length = arguments.length;
      if (!length) {
        return '';
      }
      var result = '';
      while (++index < length) {
        var codePoint = Number(arguments[index]);
        if (
          !isFinite(codePoint) || // `NaN`, `+Infinity`, or `-Infinity`
          codePoint < 0 || // not a valid Unicode code point
          codePoint > 0x10FFFF || // not a valid Unicode code point
          floor(codePoint) != codePoint // not an integer
        ) {
          throw RangeError('Invalid code point: ' + codePoint);
        }
        if (codePoint <= 0xFFFF) { // BMP code point
          codeUnits.push(codePoint);
        } else { // Astral code point; split in surrogate halves
          // http://mathiasbynens.be/notes/javascript-encoding#surrogate-formulae
           codePoint -= 0x10000;
          highSurrogate = (codePoint >> 10) + 0xD800;
          lowSurrogate = (codePoint % 0x400) + 0xDC00;
          codeUnits.push(highSurrogate, lowSurrogate);
        }
        if (index + 1 == length || codeUnits.length > MAX_SIZE) {
          result += stringFromCharCode.apply(null, codeUnits);
          codeUnits.length = 0;
        }
      }
      return result;
    };
    if (defineProperty) {
      defineProperty(String, 'fromCodePoint', {
        'value': fromCodePoint,
        'configurable': true,
        'writable': true
      });
    } else {
      String.fromCodePoint = fromCodePoint;
    }
  }());
}
for (var j = 'A'.charCodeAt(); j <= 'Z'.charCodeAt(); j++){
  var s = String.fromCodePoint(j);
  for (var i = 0; i < 0x10FFFF; i++) {
    var e = String.fromCodePoint(i);
    if (s == e.toUpperCase() && s != e) {
      document.write("char: "+e+"<br/>");
  };
};
}

结果我们可以看到：

其中混入了两个奇特的字符"ı"、"ſ"。

这两个字符的“大写”是I和S。也就是说"ı".toUpperCase() == 'I'，"ſ".toUpperCase() == 'S'。通过这个小特性可以绕过一些限制。

同样，toLowerCase也有同样的字符：

这个"K"的“小写”字符是k，也就是"K".toLowerCase() == 'k'.

用这个特性可以完成 http://prompt.ml/9 等，实战里也会遇到一些案例。

[原文地址]

各种吐槽：

Kuuki | 2014-09-25 01:06

P神我是一楼吗好鸡冻

sky (http://www.03sec.com/) | 2014-09-25 01:40

3楼是我儿

mramydnei | 2014-09-25 02:00

toLowerCase()还有个U+0130

懒懒滴1994 (安不全,只希望更安全呗-人长得丑。) | 2014-09-25 12:31

刚重新看了js精通之路，不错。

Sogili (.) 长短短 (.) | 2014-09-25 13:21

楼主关注下 http://shazzer.co.uk/

文章目录