I'm basing my comment on the article. Since they are susceptible to ASCII smuggling, they can't have been doing unicode normalization.

The task isn't that massive. Python's unicodedata (for example) contains all the info already. Including the normalization (not denormalization as I wrote before) function.

Is there something I'm missing?