Characters that expand upon toUpperCase()

Useful to bypass strict length checks and differentials between toUpperCase() / toLowerCase() .

Created byDreyAnd

Created Apr 10, 2024

Updated May 23, 2025

Detecting browser...

CategoryJavaScript Syntax

VisibilityPublic

TypeJS

CharsetUTF-8

Code used before fuzz:

function isASCII(str) {0x0D
  for (var i = 0; i < str.length; i++) {0x0D
    if (str.charCodeAt(i) > 127) {0x0D
      return false;0x0D
    }0x0D
  }0x0D
  return true;0x0D
}

Template used:

const c = String.fromCodePoint(i)0x0D
const c_upper = c.toUpperCase()0x0D
if (c_upper.length > c.length && isASCII(c_upper)){0x0D
    log(c)0x0D
}

Sample payloads

const c = String.fromCodePoint(i)0x0D
const c_upper = c.toUpperCase()0x0D
if (c_upper.length > c.length && isASCII(c_upper)){0x0D
    alert(c)0x0D
}

Characters that expand upon toUpperCase()

Sample payloads

Fuzz results

Distributed Fuzzing