29 ms·

Here is an example, open it in an appropriate editor (vi) and you can see how easy it is to 'exploit' (if you can call it that?). https://github.com/nickbouche

Here is an example, open it in an appropriate editor (vi) and you can see how easy it is to 'exploit' (if you can call it that?). https://github.com/nickboucher/trojan-source/blob/main/JavaScript/stretched-string.js https://github.com/nickboucher/trojan-source/blob/main/JavaS... Seams like a layer 8 problem?

brundolf 5y ago
GitHub has already updated their UI I see
- techsolomon 5y ago
  Changelog – https://github.blog/changelog/2021-10-31-warning-about-bidirectional-unicode-text/ https://github.blog/changelog/2021-10-31-warning-about-bidir...
- Groxx 5y ago
  The Android app renders it much more suspiciously too, though unfortunately no warning: https://imgur.com/a/L3sNFQ8 https://imgur.com/a/L3sNFQ8
Semaphor 5y ago
In case there are people who (currently) don’t have access to such an editor, here is a screenshot: https://i.imgur.com/2Ue2Vvd.png https://i.imgur.com/2Ue2Vvd.png
siddhesh 5y ago
You mean, like this? https://imgur.com/a/unKuOoK https://imgur.com/a/unKuOoK Snark aside, most text based editors have some giveaway or another. Even the GUI ones show syntax highlighting quirks that show that something is wrong. This is only really relevant in unicode-aware terminals, without syntax highlighting and when you don't get to scroll between characters. IOW, it's really quite hard to do.