4 ms·
Agreed, but I'm still curious (and don't know the answer) how often someone actually needs to put a "Bidi override" in a comment... if I were a language designe
by jrochkind1 5y ago
Agreed, but I'm still curious (and don't know the answer) how often someone actually needs to put a "Bidi override" in a comment... if I were a language designer I'd be tempted to just say they aren't allowed in comments or identifiers or anywhere but string literals/data, and have the compiler/interpreter just reject it.
(I have used a bidi override before myself, for non-malicious purposes!)
- account42 5y ago> anywhere but string literals/data The examples [0] posted in this thread have the bidi characters inside a string literal. [0] https://gitlab.com/gitlab-org/gitlab/-/commit/3fb44197195b5789b99a13f7bf482e9a895dfc58#d76713df4cefd971a10890e45d9570108c2be2aa_39_48 https://gitlab.com/gitlab-org/gitlab/-/commit/3fb44197195b57...
- jrochkind1 5y agoI'm not sure what they are being posted as examples of there? Can a bidi char in a string literal be succesfully used in the sort of attack in the OP, a "Trojan Source" attack? If so, that is devious! It's not clear to me if those example show that though. They show bidi characters being highlighted in a string literal, right. My hypothesis was that such could not be part of a "trojan source" attack... but this stuff is confusing and I could have it wrong?