CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User

What about the case where the program processing it fails to properly
normalize the text (e.g. realize that it doesn't matter if smart quotes or
not, or an ASCII a or different a is used?) in the case of Grammarly:

I don't believe this falls into CWE-180: Incorrect Behavior Order: Validate
Before Canonicalize because you can't necessarily canonicalize random user
text input, e.g. maybe they used a Hungarian word on purpose. This is more
like a source code matching problem where they renamed some variables but
the "meaning" is still the same.

Kurt Seifried (He/Him)

Reply via email to