Unicode联盟发布了技术标准UTS #39，该规范为检测和防止因Unicode字符使用不当引发的安全攻击提供了系统性解决方案1。作为已获批准的稳定文档，UTS #39规定了包括标识符安全配置文件、混淆检测函数、混合脚本检测在内的多种安全机制1，适用于域名、邮箱地址和编程语言标识符等多个应用场景1。
规范共包含五个主要符合性条款，分别为通用标识符安全配置文件、IDN安全配置文件、邮箱安全配置文件、混淆检测函数、以及混合脚本、限制级别与混合数字检测1。其中，Identifier_Status属性被定义为Allowed和Restricted两种状态1。针对特殊字符的使用，规范规定零宽非连接符（ZWNJ）和零宽连接符（ZWJ）仅在满足A1、A2、B三个特定上下文条件下方可使用1。
从Unicode 17.0版本起，数据文件不再采用版本化目录结构1。而从版本6.3.0开始，文档版本号改为标注所基于的UCD版本1。
Unicode Technical Standard #39 establishes security mechanisms designed to detect and prevent attacks arising from improper use of Unicode characters.1 Approved as a stable document by the Unicode Consortium, the standard provides multiple security features applicable to domain names, email addresses, and programming language identifiers.1
The specification defines five principal conformance clauses: a general identifier security profile, an IDN security profile, an email security profile, a confusable detection function, and detection mechanisms for mixed scripts, restriction levels, and mixed digits.1 The Identifier_Status property within the framework includes two states—Allowed and Restricted—to govern character usage.1 Additionally, zero-width non-joiner (ZWNJ) and zero-width joiner (ZWJ) characters are permitted only under specific contextual conditions meeting three criteria designated A1, A2, and B.1 Reference data files are maintained at https://www.unicode.org/Public/18.0.0/security/, and beginning with Unicode 17.0, these files no longer use version-specific directories.1 Documentation versioning was adjusted after version 6.3.0 to indicate the underlying Unicode Character Database version upon which each standard is based.1
评论
还没有评论，欢迎留下第一条。