
Security News
AGENTS.md Gains Traction as an Open Format for AI Coding Agents
AGENTS.md is a fast-growing open format giving AI coding agents a shared, predictable way to understand project setup, style, and workflows.
confusable-homoglyphs
Advanced tools
Detect confusable usage of unicode homoglyphs, prevent homograph attacks.
[doc] <http://confusable-homoglyphs.readthedocs.io/en/latest/>
__This project has been adopted from the original confusable_homoglyphs by Victor Felder <https://github.com/vhf/confusable_homoglyphs/tree/master>
_.
.. image:: https://builds.sr.ht/~valhalla/confusable_homoglyphs.svg :target: https://builds.sr.ht/~valhalla/confusable_homoglyphs :alt: Build Status
.. image:: https://img.shields.io/pypi/v/confusable_homoglyphs.svg :target: https://pypi.python.org/pypi/confusable_homoglyphs :alt: Version on PyPi
.. image:: https://readthedocs.org/projects/confusable_homoglyphs/badge/?version=latest :target: http://confusable-homoglyphs.readthedocs.io/en/latest/ :alt: Documentation Status
a homoglyph is one of two or more graphemes, characters, or glyphs with
shapes that appear identical or very similar
wikipedia:Homoglyph <https://en.wikipedia.org/wiki/Homoglyph>
__
Unicode homoglyphs can be a nuisance on the web. Your most popular client, AlaskaJazz, might be upset to be impersonated by a trickster who deliberately chose the username ΑlaskaJazz.
AlaskaJazz
is single script: only Latin characters.ΑlaskaJazz
is mixed-script: the first character is a greek
letter.You might also want to avoid people being tricked into entering their
password on www.microsоft.com
or www.faϲebook.com
instead of
www.microsoft.com
or www.facebook.com
. Here is a utility <http://unicode.org/cldr/utility/confusables.jsp>
__ to play
with these confusable homoglyphs.
Not all mixed-script strings have to be ruled out though, you could only exclude mixed-script strings containing characters that might be confused with a character from some unicode blocks of your choosing.
Allo
and ρττ
are fine: single script.AlloΓ
is fine when our preferred script alias is 'latin': mixed
script, but Γ
is not confusable.Alloρ
is dangerous: mixed script and ρ
could be confused with
p
.This library is compatible with Python 3.
API documentation <http://confusable-homoglyphs.readthedocs.io/en/latest/apidocumentation.html>
__Yep.
The unicode blocks aliases and names for each character are extracted
from this file <http://www.unicode.org/Public/UNIDATA/Scripts.txt>
__
provided by the unicode consortium.
The matrix of which character can be confused with which other
characters is built using this file <http://www.unicode.org/Public/security/latest/confusables.txt>
__
provided by the unicode consortium.
This data is stored in two JSON files: categories.json
and
confusables.json
. If you delete them, they will both be recreated by
downloading and parsing the two abovementioned files and stored as JSON
files again.
Initial release.
allowed_categories
renamed to allowed_aliases
Courtesy of Ryan P Kilby, via https://github.com/vhf/confusable_homoglyphs/pull/6 :
confusable_homoglyphs
package directory instead of the user's current working directory.cli
bundle, eg. pip install confusable_homoglyphs[cli]
.FAQs
Detect confusable usage of unicode homoglyphs, prevent homograph attacks.
We found that confusable-homoglyphs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
AGENTS.md is a fast-growing open format giving AI coding agents a shared, predictable way to understand project setup, style, and workflows.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.