11 ms·

\u000A\u002F\u002A is the unicode for the beginning of a multi-line comment (\u000A\u002A\u002F being the end of one). The Java compiler will translate it as a

by fnovd 10y ago

\u000A\u002F\u002A is the unicode for the beginning of a multi-line comment (\u000A\u002A\u002F being the end of one). The Java compiler will translate it as a comment while the PHP interpreter will ignore it (see https://www.reddit.com/r/ProgrammerHumor/comments/50guhc/this_snippet_of_code_is_syntactically_valid_in/d73x8gs https://www.reddit.com/r/ProgrammerHumor/comments/50guhc/thi... for more info).

ars 10y ago
Looks like the color coding on github doesn't understand it and doesn't gray it out like it should.
chias 10y ago
Interesting, thank you for explaining! Given that they're prefixed with //, why does the sequence get interpreted at all? IIRC "///[star]" does not open a block comment. EDIT: oh! That's what the 0x0a is for -- it's a line feed, which puts the /[star] onto the next line. Sneaky. EDIT2: hmmmm HN formatting... had to replace my asterisks with [star] because it was just italicizing everything in between.
mistercow 10y ago
Wow, that seems really dangerous. Apparently, this also applies inside string literals: http://javajee.com/unicode-escapes-in-java http://javajee.com/unicode-escapes-in-java So if you want to sneak in a back door, all you need is the right excuse to put some unicode escapes in a block comment, and you can hide your code in plain sight. Something like: https://gist.github.com/anonymous/f33c1e392193a9ec30dcc5b31dd324be https://gist.github.com/anonymous/f33c1e392193a9ec30dcc5b31d... I tried this in Eclipse, and the one saving grace is that while the basic syntax highlighting doesn't pick up on most of the de-commented part, the code intel seems to do an actual parse, and does a very subtle highlighting of "someService". (Edit: After reopening the file, that highlight is gone and it looks like a normal comment). But if I saw that, I think I'd just assume the syntax coloring was messing up. And of course, if I'm looking at the code in GitHub, it will look just like a normal comment.
- yorwba 10y ago
  I just tried this in Android Studio, Eclipse, Emacs, Gedit, Nano, Vim and all of them get this wrong. I feel the sudden urge to test every Java syntax highlighter in use and file lots of issues.
  - lsiebert 10y ago
    oh please do.
  - i336_ 10y ago
    GitHub definitely needs to know about this due to their popularity and subsequent lowest-common-denominator status (which isn't a bad thing, just the truth); this sort of attack only requires a PhD in how to use the clipboard, and not any other particular knowledge or skillset.
    - yorwba 10y ago
      GitHub indirectly uses the Java bundle for TextMate, where I filed this issue: https://github.com/textmate/java.tmbundle/issues/45 https://github.com/textmate/java.tmbundle/issues/45 Since the escape sequences have to be handled everywhere, it seems unlikely that this will ever be fixed completely, but I hope that something will be done about it.
      - yorwba 10y ago
        This issue has also been raised on the Eclipse bug tracker: https://bugs.eclipse.org/bugs/show_bug.cgi?id=3533 https://bugs.eclipse.org/bugs/show_bug.cgi?id=3533 In 2001.
        i336_ 10y ago
        That is insane. I added a pingback to this thread to the bug, along with some general encouragement that fixing this is a wise idea.

by fnovd 10y ago

ars 10y ago

Looks like the color coding on github doesn't understand it and doesn't gray it out like it should.

chias 10y ago

Interesting, thank you for explaining! Given that they're prefixed with //, why does the sequence get interpreted at all? IIRC "///[star]" does not open a block comment. EDIT: oh! That's what the 0x0a is for -- it's a line feed, which puts the /[star] onto the next line. Sneaky. EDIT2: hmmmm HN formatting... had to replace my asterisks with [star] because it was just italicizing everything in between.

mistercow 10y ago

Wow, that seems really dangerous. Apparently, this also applies inside string literals: http://javajee.com/unicode-escapes-in-java http://javajee.com/unicode-escapes-in-java So if you want to sneak in a back door, all you need is the right excuse to put some unicode escapes in a block comment, and you can hide your code in plain sight. Something like: https://gist.github.com/anonymous/f33c1e392193a9ec30dcc5b31dd324be https://gist.github.com/anonymous/f33c1e392193a9ec30dcc5b31d... I tried this in Eclipse, and the one saving grace is that while the basic syntax highlighting doesn't pick up on most of the de-commented part, the code intel seems to do an actual parse, and does a very subtle highlighting of "someService". (Edit: After reopening the file, that highlight is gone and it looks like a normal comment). But if I saw that, I think I'd just assume the syntax coloring was messing up. And of course, if I'm looking at the code in GitHub, it will look just like a normal comment.

yorwba 10y ago
I just tried this in Android Studio, Eclipse, Emacs, Gedit, Nano, Vim and all of them get this wrong. I feel the sudden urge to test every Java syntax highlighter in use and file lots of issues.
- lsiebert 10y ago
  oh please do.
- i336_ 10y ago
  GitHub definitely needs to know about this due to their popularity and subsequent lowest-common-denominator status (which isn't a bad thing, just the truth); this sort of attack only requires a PhD in how to use the clipboard, and not any other particular knowledge or skillset.
  - yorwba 10y ago
    GitHub indirectly uses the Java bundle for TextMate, where I filed this issue: https://github.com/textmate/java.tmbundle/issues/45 https://github.com/textmate/java.tmbundle/issues/45 Since the escape sequences have to be handled everywhere, it seems unlikely that this will ever be fixed completely, but I hope that something will be done about it.
    - yorwba 10y ago
      This issue has also been raised on the Eclipse bug tracker: https://bugs.eclipse.org/bugs/show_bug.cgi?id=3533 https://bugs.eclipse.org/bugs/show_bug.cgi?id=3533 In 2001.
      - i336_ 10y ago
        That is insane. I added a pingback to this thread to the bug, along with some general encouragement that fixing this is a wise idea.