Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
Unix & Linux ServerKDE Sets Ambitious Goals for 2026 and Beyond(23.09.2026 um 22:28 Uhr)
Unix & Linux ServerDSA-6510-1 xdg-dbus-proxy - security update(23.09.2026 um 02:00 Uhr)
Sichere ProgrammierungAPI & API Rest(23.09.2026 um 22:22 Uhr)
Unix & Linux ServerKDE Sets Ambitious Goals for 2026 and Beyond(23.09.2026 um 22:28 Uhr)
Unix & Linux ServerDSA-6510-1 xdg-dbus-proxy - security update(23.09.2026 um 02:00 Uhr)
Sichere ProgrammierungAPI & API Rest(23.09.2026 um 22:22 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

CodeSOD: A Percise Parser

Thomas worked for a company based in Germany which was looking to expand internationally. Once they started servicing other locales, things started to break. It didn't take long to track the problem down to a very "percise" numeric…

0
↗ Quelle (thedailywtf.com)
Reagiere als Erste:r — dein Feedback zählt!

Thomas worked for a company based in Germany which was looking to expand internationally. Once they started servicing other locales, things started to break. It didn't take long to track the problem down to a very "percise" numeric parser.


handleInput( value ){
let value_ = value;
if( value.substring( 0, 1 ) === '+' ){
value_ = value.substring( 1 );
}

value_ = value_.split( '.' ).join( '' );

if( this.usePercisionIfPercentage && value_.indexOf( ',' ) >= 0 ) {
const parsedPreValue = value_.split( ',' )[ 0 ];
const parsedCommaValue = parseInt( value_.split( ',' )[ 1 ], 10 ) < 10 ?
parseInt( value_.split( ',' )[ 1 ], 10 ) * 10 : value_.split( ',' )[ 1 ].substring( 0, 2 );

if( parsedCommaValue === 0 ) {
value_ = parseInt( parsedPreValue, 10 );
}
else {
const parsedValue = parseInt( parsedPreValue + parsedCommaValue, 10 );
value_ = parseInt( parsedValue, 10 ) / 100;
}
}

// do stuff with value_
}

We start by checking if the first character of our input value is a "+", and if it is, we strip it off, storing the result in value_. Then, we split on "."- the thousands separator in their locale- and join it all back together.


Then we attempt to parse the number, first by checking if this.usePercisionIfPercentage is true, and if the value_ contains a ","- our decimal separator.


If it does, we split the string, taking the whole numbered portion in one variable, and doing a song and dance to ensure we only grab two characters of the decimal version. The song and dance involves splitting the string multiple times, parsing it into an int multiple times, and a spare ternary for good measure.


Finally, we put the halves of the number back together… by adding them together, taking advantage of string munging to do it. We add parsedPreValue to parsedCommaValue which, because this is JavaScript and parsedPreValue is still a string (despite parsedCommaValue being an integer), we're concatenating, not adding. We concatenate the values together and divide by 100 to get the "percision" we want.


Notably: if usePercisionIfPercentage is set, and the input has a fractional portion, we end up populating value_ with an integer. But if that's not true, by the time we hit // do stuff with value_, it's still a string.


It wasn't a huge amount of effort for Thomas to strip this out and replace it with a call to a locale-aware number parser. It was much more effort to understand how this code happened in the first place.



[Advertisement]
ProGet’s got you covered with security and access controls on your NuGet feeds. Learn more.

IR-PLAYBOOK-RCE
HIGH
SOC Incident Playbook: Remote Code Execution (RCE) Defense
1-Click Detection Engineering: Sigma & YARA Rules
SOC Ready
title: Detect Exploitation - CodeSOD: A Percise Parser
id: 221f0716-9400-485a-ab45-e3ccfbd4f3e9
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-23
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-23"
        description = "YARA Signature for "
    strings:
        $str = "CodeSOD: A Percise Parser" ascii wide
    condition:
        any of them
}
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten CodeSOD: A Percise Parser

Thematisch verwandte Begriffe: CodeSOD, Percise, Parser · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-90904 | Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) i…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick