Control Character Injection In Messages

Summary

This report involved the injection of control characters, such as Null Byte 0x00, into vulnerable fields in the Message endpoints in order to cause unexpected, harmful behaviors. Our solution was to both block control characters from being saved on the backend when included in user-input, as well as to suppress the output and rendering of previously-submitted control characters.

The impact of this issue : is that the injector user can make the browser fails to load the response containing control characters and victim user would not be able to view messages %00 .