Hello.
Using trim() for binary data sounds like a mistake. There's nothing special
in whitespace or any other characters in binary data, so why use trim() for
it at all? If someone using trim for binary data, then this might be
deliberate choose. For example, trimming zero byte might be the sole cause.
That's why I disagree with "Secondly" RFC point.

Java's String.trim() treat characters with code points equals or less
than \u0020 as whitespace. So there's no "surprising case" at least for
java developers and that's why I disagree with "Thirdly" point.

However, I agree with "Firstly" point. But for semantic purists we
have mb_trim function.

Removing \0 from trim() makes code vulnerable to null byte injection attack
[1]. I have strong feeling that zero byte was added to trim() exactly by
this cause.

[1] https://owasp.org/www-community/attacks/Embedding_Null_Code

Reply via email to