Text Injection But Make It Spicy: Rendering QR Codes With Unicode Block Characters

tl;dr When the stars stylesheets align just right, it’s possible to escalate a harmless content injection issue to a marginally less harmless one by using certain Unicode characters to stand in for pixels in a QR code. (For fun, not profit.) Read on for details. In this article I’ll be showing you how I was able to render arbitrary QR codes in a web app that was not at all designed to do that,…