<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 7/24/2025 11:05 AM, Karl Williamson
via Unicode wrote:<br>
</div>
<blockquote type="cite"
cite="mid:cccb6c09-3315-449a-8aed-6e275bda82cb@khwilliamson.com">Perusing
<a class="moz-txt-link-freetext" href="https://www.unicode.org/versions/Unicode16.0.0/core-spec/chapter-3/#G54355">https://www.unicode.org/versions/Unicode16.0.0/core-spec/chapter-3/#G54355</a>,
I noticed it refers to Unicode Technical Report #36, “Unicode
Security Considerations.” This TR is stabilized. That reference
should be replaced with something current.
<br>
<br>
I then went to the unicode.org home page to find how to report
this. Not seeing anything obvious in the menus, I entered in the
search box
<br>
<br>
report defect
<br>
<br>
No relevant result came up.
<br>
<br>
</blockquote>
<p><font face="Candara">When reporting the issue, note should be
made of the actual text the link attempts to cite:</font></p>
<p><br>
</p>
<blockquote>
<h3> 3.5 <a name="Deletion_of_Noncharacters"
href="https://www.unicode.org/reports/tr36/tr36-15.html#Deletion_of_Noncharacters">Deletion
of Code Points</a> </h3>
<p>In some versions prior to Unicode 5.2, conformance clause C7
allowed the deletion of noncharacter code points:</p>
<blockquote> C7. When a process purports not to modify the
interpretation of a valid coded character sequence, it shall
make no change to that coded character sequence other than the
possible replacement of character sequences by their
canonical-equivalent sequences <i><strong>or the deletion of
noncharacter code points</strong></i><strong>. </strong> </blockquote>
<p>Whenever a character is invisibly deleted (instead of
replaced), such as in this older version of C7, it may cause a
security problem. The issue is the following: A gateway might be
checking for a sensitive sequence of characters, say "delete".
If what is passed in is "deXlete", where X is a noncharacter,
the gateway lets it through: the sequence "deXlete" may be in
and of itself harmless. However, suppose that later on, past the
gateway, an internal process invisibly deletes the X. In that
case, the sensitive sequence of characters is formed, and can
lead to a security breach.</p>
<p>The following is an example of how this can be used for
malicious purposes.</p>
<p> <a href=“java<strong>\uFEFF</strong>script:alert("XSS")>
</p>
</blockquote>
<blockquote> </blockquote>
<p><br>
</p>
<p><font face="Candara">In the landing page for the stabilized TR,
it says "</font>Some material may still be useful, and may be
extracted in the future for use in other specifications.<font
face="Candara">" The task here cannot simply be to to delete
the link, but to move the affected text into the core spec (or
some other document). A defect report would be more useful if it
contained a suggestion to that effect.</font></p>
<p><font face="Candara">A./</font></p>
<p><font face="Candara"><br>
</font></p>
</body>
</html>