Bypassing Input Filters with Full-Width Characters: A Cybersecurity Deep Dive

By /

Listen to this Post

Featured Image

Introduction

Input validation is a critical security measure to prevent attacks like Cross-Site Scripting (XSS). However, attackers often bypass filters using unconventional methods, such as full-width characters—a technique leveraging East Asian Unicode characters that occupy double the space of standard half-width characters. This article explores how attackers exploit normalization flaws to execute XSS and other injection attacks.

Learning Objectives

  • Understand how full-width characters evade input validation.
  • Learn to test and mitigate normalization-based bypasses.
  • Apply defensive coding practices to handle Unicode attacks.

1. Full-Width vs. Half-Width Characters

Verified Code Snippet (Python):

 Convert half-width to full-width 
def half_to_full(s): 
return ''.join(chr(ord(c) + 0xFEE0) if 33 <= ord(c) <= 126 else c for c in s)

print(half_to_full("<script>alert(1)</script>"))

Step-by-Step Guide:

  1. Purpose: Converts ASCII characters (e.g., <, >) to visually similar full-width equivalents (e.g., ＜, ＞).
  2. Attack Use Case: If an app filters half-width `