Close Menu
    DevStackTipsDevStackTips
    • Home
    • News & Updates
      1. Tech & Work
      2. View All

      How To Prevent WordPress SQL Injection Attacks

      June 14, 2025

      This week in AI dev tools: Apple’s Foundations Model framework, Mistral’s first reasoning model, and more (June 13, 2025)

      June 13, 2025

      Open Talent platforms emerging to match skilled workers to needs, study finds

      June 13, 2025

      Java never goes out of style: Celebrating 30 years of the language

      June 12, 2025

      6 registry tweaks every tech-savvy user must apply on Windows 11

      June 14, 2025

      Here’s why network infrastructure is vital to maximizing your company’s AI adoption

      June 14, 2025

      The AI video tool behind the most viral social trends right now

      June 14, 2025

      Got a new password manager? How to clean up the password mess you left in the cloud

      June 14, 2025
    • Development
      1. Algorithms & Data Structures
      2. Artificial Intelligence
      3. Back-End Development
      4. Databases
      5. Front-End Development
      6. Libraries & Frameworks
      7. Machine Learning
      8. Security
      9. Software Engineering
      10. Tools & IDEs
      11. Web Design
      12. Web Development
      13. Web Security
      14. Programming Languages
        • PHP
        • JavaScript
      Featured

      Right Invoicing App for iPhone: InvoiceTemple

      June 14, 2025
      Recent

      Right Invoicing App for iPhone: InvoiceTemple

      June 14, 2025

      Tunnel Run game in 170 lines of pure JS

      June 14, 2025

      Integrating Drupal with Salesforce SSO via SAML and Dynamic User Sync

      June 14, 2025
    • Operating Systems
      1. Windows
      2. Linux
      3. macOS
      Featured

      Windows 11 24H2 tests toggle to turn off Recommended feed in the Start menu

      June 14, 2025
      Recent

      Windows 11 24H2 tests toggle to turn off Recommended feed in the Start menu

      June 14, 2025

      User calls Windows 11 “pure horror,” Microsoft says it’s listening to feedback

      June 14, 2025

      John the Ripper is an advanced offline password cracker

      June 14, 2025
    • Learning Resources
      • Books
      • Cheatsheets
      • Tutorials & Guides
    Home»News & Updates»CodeSOD: The Wrong Kind of Character

    CodeSOD: The Wrong Kind of Character

    April 29, 2025

    Today’s code, at first, just looks like using literals instead of constants. Austin sends us this C#, from an older Windows Forms application:

    if (e.KeyChar == (char)4) {   // is it a ^D?
            e.Handled = true;
            DoStuff();
    }
    else if (e.KeyChar == (char)7) {   // is it a ^g?
            e.Handled = true;
            DoOtherStuff();
    }
    else if (e.KeyChar == (char)Keys.Home) {
            e.Handled = true;
            SpecialGoToStart();
    }
    else if (e.KeyChar == (char)Keys.End) {
            e.Handled = true;
            SpecialGoToEnd();
    } 
    

    Austin discovered this code when looking for a bug where some keyboard shortcuts didn’t work. He made some incorrect assumptions about the code- first, that they were checking for a KeyDown or KeyUp event, a pretty normal way to check for keyboard shortcuts. Under that assumption, a developer would compare the KeyEventArgs.KeyCode property against an enum- something like e.KeyCode == Keys.D && Keys.Control, for a CTRL+D. That’s clearly not what’s happening here.

    No, here, they used the KeyPressEvent, which is meant to represent the act of typing. That gives you a KeyPressEventArgs with a KeyChar property- because again, it’s meant to represent typing text not keyboard shortcuts. They used the wrong event type, as it won’t tell them about modifier keys in use, or gracefully handle the home or end keys. KeyChar is the ASCII character code of the key press: which, in this case, CTRL+D is the “end of transmit” character in ASCII (4), and CTRL+G is the goddamn bell character (7). So those two branches work.

    But home and end don’t have ASCII code points. They’re not characters that show up in text. They get key codes, which represent the physical key pressed, not the character of text. So (char)Keys.Home isn’t really a meaningful operation. But the enum is still a numeric value, so you can still turn it into a character- it just turns into a character that emphatically isn’t the home key. It’s the “$”. And Keys.End turns into a “#”.

    It wasn’t very much work for Austin to move the event handler to the correct event type, and switch to using KeyCodes, which were both more correct and more readable.

    [Advertisement]
    Keep all your packages and Docker containers in one place, scan for vulnerabilities, and control who can access different feeds. ProGet installs in minutes and has a powerful free version with a lot of great features that you can upgrade when ready.Learn more.

    Source: Read More 

    Facebook Twitter Reddit Email Copy Link
    Previous ArticleFog Ransomware Directory With Active Directory Exploitation Tools & Scripts Uncovered
    Next Article Oshin OS is an Arch Linux distribution

    Related Posts

    News & Updates

    6 registry tweaks every tech-savvy user must apply on Windows 11

    June 14, 2025
    News & Updates

    Here’s why network infrastructure is vital to maximizing your company’s AI adoption

    June 14, 2025
    Leave A Reply Cancel Reply

    For security, use of Google's reCAPTCHA service is required which is subject to the Google Privacy Policy and Terms of Use.

    Continue Reading

    Exploring institutions for global AI governance

    Artificial Intelligence

    Linux Mint 22.2 Modernises its Default Theme

    Linux

    CVE-2023-36636 – Apache HTTP Server File Inclusion

    Common Vulnerabilities and Exposures (CVEs)

    CVE-2024-9771 – WordPress WP-Recall Stored Cross-Site Scripting Vulnerability

    Common Vulnerabilities and Exposures (CVEs)

    Highlights

    CVE-2025-5858 – PHPGurukul Nipah Virus Testing Management System SQL Injection

    June 9, 2025

    CVE ID : CVE-2025-5858

    Published : June 9, 2025, 3:15 a.m. | 1 hour, 2 minutes ago

    Description : A vulnerability was found in PHPGurukul Nipah Virus Testing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /patient-report.php. The manipulation of the argument searchdata leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

    Severity: 6.3 | MEDIUM

    Visit the link for more details, such as CVSS details, affected products, timeline, and more…

    Your Windows 10 PC isn’t dead yet – this OS from Google can revive it

    April 18, 2025

    CVE-2025-44115 – Cotonti Siena Cross-Site Scripting Vulnerability

    June 2, 2025

    Celluloid 0.28 Adds Lua Module Support, Refreshes UI

    April 6, 2025
    © DevStackTips 2025. All rights reserved.
    • Contact
    • Privacy Policy

    Type above and press Enter to search. Press Esc to cancel.