Editing UTF-8 (section)

=== Overlong encodings ===
{{anchor|overlong encodings}}

Using a row in the above table to encode a code point less than "First code point" (thus using more bytes than necessary) is termed an ''overlong encoding''. These are a security problem because they allow character sequences such as malicious JavaScript and <code>[[directory traversal attack|../]]</code> to bypass security validations, which has been reported in numerous high-profile products such as Microsoft's [[Internet Information Services|IIS]] web server<ref name=MS00-078>{{ cite report | first = Marvin |last = Marin | date = 2000-10-17 | title = Windows NT UNICODE vulnerability analysis | department = Web server folder traversal | id = MS00-078 | series = Malware FAQ | website=SANS Institute | url=https://www.sans.org/resources/malwarefaq/wnt-unicode.php | url-status=dead | archive-url=https://web.archive.org/web/20140827001204/http://www.sans.org/security-resources/malwarefaq/wnt-unicode.php | archive-date=Aug 27, 2014 }}</ref> and Apache's Tomcat servlet container.<ref name=CVE-2008-2938>{{ cite web | title = CVE-2008-2938 | year = 2008 | website = National Vulnerability Database (nvd.nist.gov) | publisher = U.S. [[National Institute of Standards and Technology]] | url = https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2008-2938 }}</ref> Overlong encodings should therefore be considered an error and never decoded. [[#Modified UTF-8|Modified UTF-8]] allows an overlong encoding of {{tt|U+0000}}.