google-utf7xss.txt

`XSS with UTF-7 in Google  
  
XSS with UTF-7 was found in www.google.com (already fixed).  
Although charset was specified in HTTP response header, but  
charset-name was incorrect so XSS occurred.  
  
PoC:  
http://www.google.com/search?hl=en&oe=cp932&q=%2BADw-script%2BAD4-alert(  
document.cookie)%2BADsAPA-/script%2BAD4-%2BACI-  
  
The "cp932" is specified for output charset with "oe" parameter,  
so responded HTTP header and <meta> in HTML from Google are like as:  
--  
Content-Type: text/html; charset=CP932  
--  
<meta http-equiv=content-type content="text/html; charset=CP932">  
--  
  
"cp932" is the similar name of the Shift_JIS encoding,  
but it is not registered as correct charset name for IE.  
IE recognizes only charset names hardocorded in MLang.dll  
like as "Shift_JIS", "EUC-JP", "EUC-KR", "UTF-8" and so on.  
  
Therefore, an automatic detection function for encoding works,  
and detect as "UTF-7".  
  
Typical incorrect charset name in japanese web pages are followings:  
  
utf8 - Idiomatic expression of "UTF-8" hyphen falls out.  
euc - Idiomatic expression of "EUC-JP"  
jis - Idiomatic expression of "ISO-2022-JP"  
MS932 / MS932 / CP942C - Comparable encodings to Shift_JIS on Java  
Windows-31J - IANA registered name for Codepage 932, but not  
registered in Windows.  
  
Status:  
Apr 17 2007  
Reported to Google via IPA/ISEC <http://www.ipa.go.jp/security/index-e.html>  
Dec 26 2007  
Received reply it fixed from Google via IPA/ISEC.  
  
`