Why JavaScript Emoji Break Text-to-Binary Converters and How to Fix It

·1 views

A common JavaScript text-to-binary function works correctly for basic ASCII characters but produces wrong results for emoji and many non-English characters. The root cause is that JavaScript strings are stored as UTF-16 code units, and the charCodeAt() method reads those units rather than generating UTF-8 bytes. Emoji like 🙂 use surrogate pairs — two UTF-16 units — so splitting a string character by character separates them, yielding incorrect output. The reliable fix is to use the TextEncoder API, which converts any string into its proper UTF-8 byte array before formatting each byte as an 8-bit binary group. For the reverse operation, TextDecoder should process the full byte array at once, with the fatal option enabled to catch malformed UTF-8 input instead of silently producing garbled text.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

JWT 'kid' Parameter Flaw Enables SQL Injection and Path Traversal Attacks

A security vulnerability in how servers process the JSON Web Token 'kid' header parameter allows attackers to manipulate key selection without breaking cryptography. Because the RFC defines no required format or character restrictions for 'kid', most libraries pass the raw value directly to database queries or file reads without sanitization. In the SQL injection variant, an attacker injects a UNION payload to make the server use an attacker-chosen HMAC key, then re-signs a forged token that passes verification. In the path traversal variant, injecting a sequence like '../../../../dev/null' causes the server to read an empty file, letting the attacker sign tokens with a predictable null-byte key. The vulnerability is rated CVSS 7.5 High, requires no prior authentication, and fully compromises authentication integrity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Major WebSocket Frameworks Leave Origin Validation Off by Default, Enabling CSWSH

Cross-Site WebSocket Hijacking (CSWSH) exploits a gap in the Same-Origin Policy, allowing attackers to establish a persistent, bidirectional, authenticated channel by tricking a logged-in user's browser into initiating a WebSocket connection to a malicious page. Unlike standard HTTP requests, the WebSocket upgrade bypasses CORS preflight entirely, sending session cookies cross-origin without restriction — a deliberate protocol design dating back to RFC 6455. Four of the five dominant WebSocket frameworks ship with Origin validation disabled by default, leaving applications exposed unless developers explicitly enable the check. Real-world consequences have been severe: CVE-2020-25095 enabled unauthentiated remote code execution on LogRhythm, CVE-2023-0957 led to full Gitpod account takeover, and CVE-2024-51775 exposed Apache Zeppelin data to unauthenticated remote attackers. Security researchers trace the recurring vulnerability to an engineering culture where WebSocket endpoints are added to cookie-authenticated apps without applying the same CSRF-era protections already in place for HTTP routes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Rust-based version bump tool claiming 10,000x speed over Python

A developer rebuilt the popular bump-my-version CLI tool in Rust after finding the Python original took a full second to increment a single version number. The new tool, called bump2version 0.2.0, automates updating version strings across multiple files such as Cargo.toml, package.json, and CHANGELOG.md in a single operation. It uses pure-Rust git integration via the gix library, avoiding subprocess calls entirely, and enforces memory safety with no unsafe code. Beyond a standalone CLI, the project exposes bindings for Python and Node.js, making the same Rust core accessible across three ecosystems. The developer acknowledged receiving outside assistance with parts of the system design during the project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Passwordless Auth Exposes Tokens in Logs, Headers, and Email Forwarding Chains

Security researchers have highlighted how passwordless authentication methods such as magic links and TOTP, despite being designed to reduce phishing risk, introduce multiple new attack surfaces. Magic link tokens embedded in GET request URLs are routinely captured in server access logs from nginx, Apache, and CDN proxies, where they remain readable until log rotation. A critical vulnerability, CVE-2026-39912 (CVSS 9.1), exposed over 7,000 instances of V2Board by returning auth tokens directly in HTTP response bodies without requiring authentication. Browser Referer headers can leak tokens to third-party analytics platforms, while email security gateways may silently consume single-use tokens during URL prefetching scans. Additionally, attackers who briefly gain inbox access can plant silent forwarding rules that continue delivering future magic link tokens even after a password reset, leaving no failed login alerts for the application to detect.

0 comments Read more at DEV Community