Logo Search packages:      
Sourcecode: icu version File versions  Download package

U_STABLE int32_t U_EXPORT2 uspoof_check ( const USpoofChecker sc,
const UChar *  text,
int32_t  length,
int32_t *  position,
UErrorCode status 

Check the specified string for possible security issues. The text to be checked will typically be an identifier of some sort. The set of checks to be performed is specified with uspoof_setChecks().

sc The USpoofChecker
text The string to be checked for possible security issues, in UTF-16 format.
length the length of the string to be checked, expressed in 16 bit UTF-16 code units, or -1 if the string is zero terminated.
position An out parameter that receives the index of the first string position that fails the allowed character limitation checks. This parameter may be null if the position information is not needed. If the string passes the requested checks the parameter value will not be set.
status The error code, set if an error occurred while attempting to perform the check. Spoofing or security issues detected with the input string are not reported here, but through the function's return value.
An integer value with bits set for any potential security or spoofing issues detected. The bits are defined by enum USpoofChecks. Zero is returned if no issues are found with the input string. ICU 4.2

Definition at line 189 of file uspoof.cpp.

References UnicodeSet::add(), UnicodeSet::clear(), UnicodeSet::contains(), SpoofImpl::fAllowedCharsSet, FALSE, SpoofImpl::fChecks, NULL, SpoofImpl::scriptScan(), TRUE, U16_NEXT, U_ILLEGAL_ARGUMENT_ERROR, U_NON_SPACING_MARK, u_strlen(), USPOOF_CHAR_LIMIT, USPOOF_INVISIBLE, USPOOF_MIXED_SCRIPT_CONFUSABLE, USPOOF_SINGLE_SCRIPT, USPOOF_WHOLE_SCRIPT_CONFUSABLE, and SpoofImpl::wholeScriptCheck().

    const SpoofImpl *This = SpoofImpl::validateThis(sc, *status);
    if (This == NULL) {
        return 0;
    if (length < -1) {
        *status = U_ILLEGAL_ARGUMENT_ERROR;
        return 0;
    if (length == -1) {
        // It's not worth the bother to handle nul terminated strings everywhere.
        //   Just get the length and be done with it.
        length = u_strlen(text);

    int32_t result = 0;
    int32_t failPos = 0x7fffffff;   // TODO: do we have a #define for max int32?

    // A count of the number of non-Common or inherited scripts.
    // Needed for both the SINGLE_SCRIPT and the WHOLE/MIXED_SCIRPT_CONFUSABLE tests.
    // Share the computation when possible.  scriptCount == -1 means that we haven't
    // done it yet.
    int32_t scriptCount = -1;

    if ((This->fChecks) & USPOOF_SINGLE_SCRIPT) {
        scriptCount = This->scriptScan(text, length, failPos, *status);
        // printf("scriptCount (clipped to 2) = %d\n", scriptCount);
        if ( scriptCount >= 2) {
            // Note: scriptCount == 2 covers all cases of the number of scripts >= 2
            result |= USPOOF_SINGLE_SCRIPT;

    if (This->fChecks & USPOOF_CHAR_LIMIT) {
        int32_t i;
        UChar32 c;
        for (i=0; i<length ;) {
            U16_NEXT(text, i, length, c);
            if (!This->fAllowedCharsSet->contains(c)) {
                result |= USPOOF_CHAR_LIMIT;
                if (i < failPos) {
                    failPos = i;

    if (This->fChecks & 
        // These are the checks that need to be done on NFKD input
        NFKDBuffer   normalizedInput(text, length, *status);
        const UChar  *nfkdText = normalizedInput.getBuffer();
        int32_t      nfkdLength = normalizedInput.getLength();

        if (This->fChecks & USPOOF_INVISIBLE) {
            // scan for more than one occurence of the same non-spacing mark
            // in a sequence of non-spacing marks.
            int32_t     i;
            UChar32     c;
            UChar32     firstNonspacingMark = 0;
            UBool       haveMultipleMarks = FALSE;  
            UnicodeSet  marksSeenSoFar;   // Set of combining marks in a single combining sequence.
            for (i=0; i<length ;) {
                U16_NEXT(nfkdText, i, nfkdLength, c);
                if (u_charType(c) != U_NON_SPACING_MARK) {
                    firstNonspacingMark = 0;
                    if (haveMultipleMarks) {
                        haveMultipleMarks = FALSE;
                if (firstNonspacingMark == 0) {
                    firstNonspacingMark = c;
                if (!haveMultipleMarks) {
                    haveMultipleMarks = TRUE;
                if (marksSeenSoFar.contains(c)) {
                    // report the error, and stop scanning.
                    // No need to find more than the first failure.
                    result |= USPOOF_INVISIBLE;
                    failPos = i;
            // The basic test is the same for both whole and mixed script confusables.
            // Compute the set of scripts that every input character has a confusable in.
            // For this computation an input character is always considered to be
            //    confusable with itself in its own script.
            // If the number of such scripts is two or more, and the input consisted of
            //   characters all from a single script, we have a whole script confusable.
            //   (The two scripts will be the original script and the one that is confusable)
            // If the number of such scripts >= one, and the original input contained characters from
            //   more than one script, we have a mixed script confusable.  (We can transform
            //   some of the characters, and end up with a visually similar string all in
            //   one script.)

            if (scriptCount == -1) {
                int32_t t;
                scriptCount = This->scriptScan(text, length, t, *status);
            ScriptSet scripts;
            This->wholeScriptCheck(nfkdText, nfkdLength, &scripts, *status);
            int32_t confusableScriptCount = scripts.countMembers();
            //printf("confusableScriptCount = %d\n", confusableScriptCount);
            if ((This->fChecks & USPOOF_WHOLE_SCRIPT_CONFUSABLE) &&
                confusableScriptCount >= 2 &&
                scriptCount == 1) {
                result |= USPOOF_WHOLE_SCRIPT_CONFUSABLE;
            if ((This->fChecks & USPOOF_MIXED_SCRIPT_CONFUSABLE) &&
                confusableScriptCount >= 1 &&
                scriptCount > 1) {
                result |= USPOOF_MIXED_SCRIPT_CONFUSABLE;
    if (position != NULL && failPos != 0x7fffffff) {
        *position = failPos;
    return result;

Generated by  Doxygen 1.6.0   Back to index