Spoofchecker クラス
(PHP 5 >= 5.4.0, PHP 7, PHP 8, PECL intl >= 2.0.0)
はじめに
Unicode は非常にたくさんの文字と、
世界中の様々な表記体系を含んでいます。
そのため使い方を誤ると、
文字の類似性を利用して、
プログラムやシステムに対するセキュリティ攻撃が成立する可能性があります。
そのため、このクラスが提供されています。
このクラスのメソッドを使うと、
個別の文字列が、文字の読み手を混乱させようとしている可能性があるかをチェック(spoof detection
)できます。
たとえば、キリル文字の 'а' が混じった
"pаypаl" のような文字列のようなものをチェックできます。
目次
Anonymous ¶6 years ago
From http://icu-project.org/apiref/icu4j/com/ibm/icu/text/SpoofChecker.html :
SINGLE_SCRIPT_CONFUSABLE: indicates that the two strings are visually confusable and that they are from the same script
MIXED_SCRIPT_CONFUSABLE: indicates that the two strings are visually confusable and that they are NOT from the same script
WHOLE_SCRIPT_CONFUSABLE: indicates that the two strings are visually confusable and that they are NOT from the same script BUT both of them are single-script strings
ANY_CASE: Deprecated.
SINGLE_SCRIPT: Deprecated.
INVISIBLE: Check an identifier for the presence of invisible characters, such as zero-width spaces, or character sequences that are likely not to display, such as multiple occurrences of the same non-spacing mark.
CHAR_LIMIT: Check that an identifier contains only characters from a specified set of acceptable characters.
Explanation of whole script, mixed script and single script confusables in UTS 39 section 4 : http://unicode.org/reports/tr39/#Confusable_Detection
Details from Java SpoofChecker class at http://icu-project.org/apiref/icu4j/com/ibm/icu/text/SpoofChecker.html
Anonymous ¶6 years ago
Spoofchecker yields false positives by defaut when Whole-Script Confusables (WSC) and Mixed-Script Confusables (MSC) checks are used.
They have been deprecated since ICU 58:
http://bugs.icu-project.org/trac/ticket/12549#comment:10
Workarounds: upgrade ICU to 58+, or avoid the MSC and WSC checks with Spoofcheckers' setChecks() function.