Web Applications Stack Exchange is a question and answer site for power users of web applications. It only takes a minute to sign up.
Sign up to join this community
Today I was surprised to see that a guy has hacked Twitter's 140-character limit. The message consists of 930 characters. How could this be possible?
The direct link to this tweet is here. For convenience, I'm copying the screenshot of full tweet below:
The message contains Unicode surrogate code points that are improperly encoded as UTF-8. This kind of improper encoding is also called CESU-8. It appears that some Twitter interfaces will accept the CESU-8 encoded surrogate code points as characters (for the purpose of the 140 character limit), but for display purposes it expects valid UTF-8 and these are not valid UTF-8 sequences. So it instead displays the 3 bytes of each of these sequences as 3 C-style octal escape sequences of 4 characters each, and each surrogate code point ends up being displayed using 12 characters.
For example \355\240\265\355\263\220 when decoded as C-escaped UTF-8, without rejecting surrogates as would normally be done when decoding UTF-8, decodes to the surrogate pair U+D835 U+DCD0. Treating this surrogate pair as UTF-16, as would be done when decoding CESU-8, produces the Unicode character U+1D4D0 MATHEMATICAL BOLD SCRIPT CAPITAL A (𝓐).
If the C-style octal escaping is decoded and then the result is interpreted as CESU-8, it comes out to:
𝓐𝓛𝓜𝓐𝓣𝓨 𝓐𝓛𝓜𝓐𝓣𝓨 𝓐𝓛𝓜𝓐𝓣𝓨 Твиттим и не ограничиваемся людиии!!!!!! 140 не предел!=)))) 𝓐𝓛𝓜𝓐𝓣𝓨 𝓐𝓛𝓜𝓐𝓣𝓨 𝓐𝓛𝓜𝓐𝓣𝓨
Here it is as an image, for those without a full set of Unicode fonts installed:
Each group of characters beginning with a backslash and followed by three numbers is an "Escape Sequence". Each of them represents a single character. These are usually used for characters that don't exist on your keyboard such as non-English-language characters and symbols.
My guess is that when counting the characters, Twitter is counting each of these groups as a single character but when displaying them to the browser it is printing them as four.
Update:
Some of the escape sequences available are "control characters". These tell the computer to do something such as playing an alert sound or moving the cursor left or right or up or down or deleting the character to the left of the cursor. Although none of them are the last one I mentioned (deleting the previous character), he might have used that character to confuse Twitter as well.
Interestingly, when turned back into normal characters, it is quite repetative and looks something like this:
í µ í ³ í µ í ³ › í µ í ³ œ í µ í ³ í µ í ³ £ í µ í ³ ¨ í µ í ³ í µ í ³ › í µ í ³ œ í µ í ³ í µ í ³ £ í µ í ³ ¨
Update 2:
The explanation he gave was "Пишите в DM, всегда на связи )" which Google Translate tells me is "Write to the DM, always on connection)". I'm not sure exactly what that means or how it helps.
