1
0
mirror of https://github.com/minimaxir/big-list-of-naughty-strings.git synced 2025-09-24 21:01:32 +02:00
Commit Graph

221 Commits

Author SHA1 Message Date
Victor Engmark
d0a73016d5 Add a shebang line
As recommended by shellcheck.
2018-11-17 07:08:19 +13:00
Victor Engmark
6bcf08beb1 Rename variable for clarity 2018-11-17 07:07:07 +13:00
Victor Engmark
e974868c76 Use idiomatic test statements 2018-11-17 07:06:34 +13:00
Victor Engmark
70e19cae9f Avoid unnecessary semicolons 2018-11-17 07:05:33 +13:00
Victor Engmark
d5a7cb5473 Fix indentation 2018-11-17 07:05:10 +13:00
Max Woolf
f56ff6ea82 Merge pull request #167 from lifengdvnera/master
Add super Unicode string
2018-11-16 00:15:47 -08:00
Lifeng Dong
980f181e22 Add super Unicode string 2018-11-15 16:55:21 +08:00
Max Woolf
4115c9deee Merge pull request #162 from charlier/resync-json
Syncronise blns JSON with txt
2018-08-05 19:12:03 -07:00
Max Woolf
8661d3fa75 Merge pull request #159 from Avaq/patch-1
Add "then" to strings which may be used elsewhere
2018-05-24 09:39:27 -07:00
Max Woolf
e8f7db444c Merge pull request #163 from dospunk/patch-1
Adds shrug to the category "Japanese Emoticons"
2018-03-19 14:19:55 -07:00
dospunk
ac1af9ad28 Adds shrug to the category "Japanese Emoticons"
¯\_(ツ)_/¯ this guy
2018-03-19 15:39:56 -04:00
Charlie Rogers
8932af02f6 Syncronise blns JSON with txt 2018-03-11 23:29:36 +00:00
Max Woolf
ba3c0bae5a Merge pull request #161 from iljavs/master
update blns to account for more format strings
2018-02-25 20:06:28 -08:00
iljavs
2a9a2c9975 update blns to account for more format strings
Made a couple of changes to the format strings:
- added more %s'. increases the chance of crashing. Sometimes the stack layout is just right and 1 or 2 %s will not cause a crash 
- added %n. Should cause a crash, even if several other specifiers don't
- added %@, this is for objective-c format functions.
2018-02-25 04:24:55 -06:00
Max Woolf
cf2b864ab7 Merge pull request #160 from Plazmaz/patch-2
Added new character for crashing iOS
2018-02-22 10:53:36 -08:00
Dylan Katz
1ec5bff108 Added new character for crashing iOS 2018-02-15 14:49:23 -07:00
Aldwin Vlasblom
85bc805f4f Add "then" to strings which may be used elsewhere
The massive adoption of Promises made many programs potentially vulnerable to "accidental Promises".

In short, a program might take user input and produce an object as such:

```js
{
  [userInput]: AnyFunction
}
```

...when the object above is given to a Promise, nothing breaks until the user input is exactly `"then"`. Once it's *then*, a Promise will assume that the object as another Promise, and in trying to assimilate this accidental Promise the function will be called. After that, one of three things will happen

1. The function calls one of the continuations provided by the Promise, and the program continues with some unexpected data (this is highly unlikely)
1. The program hangs and never terminates (if the function stores input in memory)
1. The program terminates early, failing to execute any other chained Promises (the more likely case)

For more in-depth information, please refer to the appropriate sections in the articles I've written regarding this issue:

1. [Broken Promises - Specialized API](https://medium.com/@avaq/broken-promises-2ae92780f33#6828)
1. [A clarification with examples to the article above](https://medium.com/@avaq/im-referring-to-the-fact-that-a-promise-is-eagerly-evaluated-as-opposed-to-lazily-evaluated-5385cc519e3b#33cd) (see the part under "I never found myself creating an object with a then method")
2017-11-10 15:28:20 +01:00
Max Woolf
c0b5382124 Merge pull request #149 from Erikmitk/patch-1
Fix broken link in README
2017-05-26 10:09:44 -07:00
Erik Sommer
c30c269cde Fix broken link in README 2017-04-04 14:18:31 +02:00
Max Woolf
8a11558493 Merge pull request #125 from zackw/add-c0-and-c1-controls
Add control characters and whitespace
2017-01-19 22:45:09 -08:00
Max Woolf
96f50492b2 Merge branch 'master' into add-c0-and-c1-controls 2017-01-19 22:44:59 -08:00
Max Woolf
47b41540e0 Merge pull request #127 from davbo/include-characters-which-change-length-when-lowercased
Unicode chars which change length when lowercased
2017-01-19 22:43:57 -08:00
Max Woolf
e7f864310c Merge pull request #128 from Luke-Diamond/master
Added `File:///` Vulnerability
2017-01-19 22:41:29 -08:00
Max Woolf
6f8b6d93d9 Merge pull request #129 from Plazmaz/patch-1
Added new iOS Crash String.
2017-01-19 22:41:16 -08:00
Dylan Katz
3f7bba623d Update blns.txt 2017-01-19 15:32:39 -07:00
Luke
115c1092c3 Added File:/// for Mac Vulnerability 2017-01-19 12:47:06 -05:00
Luke
1561d9e19c Added File:/// for Mac Vulnerability 2017-01-19 12:46:38 -05:00
David King
0b0f6ec999 Unicode chars which change length when lowercased
These two characters change byte length when lowercased which is quite
unique behavior. This can potentially cause issues where assumptions
about input length == length after processing.
2017-01-19 15:07:22 +00:00
Zack Weinberg
1775ec88b8 Regenerate derived files. 2017-01-19 08:38:59 -05:00
Zack Weinberg
a34eb03d01 Merge branch 'master' into add-c0-and-c1-controls 2017-01-19 08:24:33 -05:00
Zack Weinberg
b3c84aaf50 Remove trailing space characters from several strings where it does not appear to be part of the naughtiness. 2017-01-19 08:18:49 -05:00
Zack Weinberg
2e4f47ddc9 Include all Unicode whitespace and control characters at least once. 2017-01-19 08:16:10 -05:00
Max Woolf
942eb29775 Merge pull request #119 from topaz/patch-1
Add missing newline to delimit sections in blns.txt
2017-01-16 13:35:35 -08:00
Eric Wastl
673da196fc Add missing newline to delimit sections in blns.txt 2017-01-16 16:32:54 -05:00
Max Woolf
8694501f8d Merge pull request #116 from AnthonySteele/Add-the-famous-dvd
Add the famous dvd
2017-01-16 08:19:59 -08:00
Anthony Steele
eb008e5366 Update blns.json 2017-01-16 16:08:22 +00:00
Anthony Steele
cf63e259ca Update blns.txt 2017-01-16 16:07:32 +00:00
Max Woolf
b8e7387e7b Merge pull request #115 from hjkuijf/master
HTML textarea
2017-01-16 07:56:23 -08:00
hjkuijf
2ea9147278 This causes an HTML textarea that is filled with unescaped input to break and execute a simple JavaScript. 2017-01-16 16:50:21 +01:00
Max Woolf
d46ed585fe Add Reddit thread 2017-01-16 07:48:44 -08:00
Max Woolf
98056309f9 Merge pull request #110 from sharpjs/modem-hangup
Add modem hangup vulnerability.
2017-01-16 07:41:08 -08:00
Max Woolf
82af50aa54 Merge branch 'master' into modem-hangup 2017-01-16 07:40:59 -08:00
Max Woolf
9e78b6e801 Merge pull request #109 from annashipman/master
Year should be year of original publication
2017-01-16 07:37:37 -08:00
Max Woolf
22e581c808 Merge pull request #108 from Aeolun/master
Put table back after we are done with it
2017-01-16 07:36:35 -08:00
Max Woolf
a6bd55445f Merge pull request #106 from RomainGehrig/master
Add signed zero
2017-01-16 07:35:59 -08:00
Jeff Sharp
5c290e94ce Add modem hangup vulnerability.
This string can cause some modems to disconnect.  Years ago, I triggered
this behavior accidentally when, for an unrelated reason, my email
signature contained the string.  Mail sent to a mailing list caused some
subscribers' modems to disconnect.

Explained here, in the final paragraph under "Hayes' Solution":
https://en.wikipedia.org/wiki/Hayes_command_set
2017-01-16 07:32:24 -06:00
Anna Shipman
b1bd98632a Year should be year of original publication
The aim of the year is to indicate when the work was originally published, in case of any dispute. You're not in the UK but this, from the UK's copyright service is useful: http://www.copyrightservice.co.uk/copyright/p03_copyright_notices, item 4.
2017-01-16 11:26:24 +00:00
Bart Riepe
6f02d4b45e Put table back after we are done with it 2017-01-16 18:38:15 +09:00
Romain Gehrig
14baec9b35 Add signed zero 2017-01-16 01:51:31 +01:00
Max Woolf
8536c79033 Year bump 2017-01-15 14:33:19 -08:00