[GUACAMOLE-1972] Client incorrectly handles Unicode codepoints greater than U+FFFF

• Type: Bug
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Fix Version/s: 1.6.1
• Component/s: guacamole-client
• Flags: Patch

Language

javascript

• Assignee: Unassigned
• Reporter: Scott Percival
• Created: 30/Jul/24 02:11
• Updated: 27/Aug/24 23:14

Description

When accepting input from the browser, Guacamole will try and convert the UTF-16 buffer provided by Javascript into UTF-8 bytes. However the parser does not take into account surrogate pairs – meaning that any Unicode codepoint greater than U+FFFF (e.g. most of the emoji range) will be wrongly treated as two UTF-16 characters, resulting in an invalid byte sequence being sent to the server.

The proposed fix is to use `String.prototype.codePointAt` instead of `String.prototype.charCodeAt`, along with validation that the codepoint in question is a surrogate pair.