3 ms·

Cool write-up. Seems pretty unintuitive to me that Unicode would allow someone to serialize normal code as invisible characters and that something like an IDE o

by nawgz 1y ago

Cool write-up. Seems pretty unintuitive to me that Unicode would allow someone to serialize normal code as invisible characters and that something like an IDE or a git diff has never been hardened against that at all. In my mind it's one thing to let a string control whitespace a bit versus having the ability to write any string in a non-renderable format. Can anyone point me to some more information about why this capability even exists?

clscott 1y ago
The issue does not lie with Unicode. It's just a custom string encoder/decoder whose encoded character set is restricted to non-printables. Many editors and IDEs have features (or plugins) to detect these characters. VSCode: https://marketplace.visualstudio.com/items?itemName=YusufDanis.hidden-character-detector https://marketplace.visualstudio.com/items?itemName=YusufDan... VIM: https://superuser.com/questions/249289/display-invisible-characters-in-vim https://superuser.com/questions/249289/display-invisible-cha...
dragonwriter 1y ago
> Seems pretty unintuitive to me that Unicode would allow someone to serialize normal code as invisible characters If you have a text encoding with two invisible characters, you can trivially encode anything that you could represent in a digital computer in it, in binary, by treating one as a zero and the other as a one. More invisible characters and some opinionated assumptions about what you are allows denser representation than one bit per character. Of course, the trick in any case is you have to also slip in the call to decode and execute the invisible code, and unless you have a very unusual language, that’s going to be very visible.
- nawgz 1y ago
  I see now, those “decode” and “eval” are huge red flags that are downplayed heavily by the author. Cheers for the response
wunderwuzzi23 1y ago
It gets even worse with LLMs and agents. Many LLMs can interpret invisible Unicode Tag characters as instructions and follow them (eg invisible comment or text in a GitHub issue). I wrote about this a few times, here a recent example with Google Jules: https://embracethered.com/blog/posts/2025/google-jules-invisible-prompt-injection/ https://embracethered.com/blog/posts/2025/google-jules-invis...

by nawgz 1y ago

clscott 1y ago

The issue does not lie with Unicode. It's just a custom string encoder/decoder whose encoded character set is restricted to non-printables. Many editors and IDEs have features (or plugins) to detect these characters. VSCode: https://marketplace.visualstudio.com/items?itemName=YusufDanis.hidden-character-detector https://marketplace.visualstudio.com/items?itemName=YusufDan... VIM: https://superuser.com/questions/249289/display-invisible-characters-in-vim https://superuser.com/questions/249289/display-invisible-cha...

dragonwriter 1y ago

> Seems pretty unintuitive to me that Unicode would allow someone to serialize normal code as invisible characters If you have a text encoding with two invisible characters, you can trivially encode anything that you could represent in a digital computer in it, in binary, by treating one as a zero and the other as a one. More invisible characters and some opinionated assumptions about what you are allows denser representation than one bit per character. Of course, the trick in any case is you have to also slip in the call to decode and execute the invisible code, and unless you have a very unusual language, that’s going to be very visible.

nawgz 1y ago
I see now, those “decode” and “eval” are huge red flags that are downplayed heavily by the author. Cheers for the response

wunderwuzzi23 1y ago

It gets even worse with LLMs and agents. Many LLMs can interpret invisible Unicode Tag characters as instructions and follow them (eg invisible comment or text in a GitHub issue). I wrote about this a few times, here a recent example with Google Jules: https://embracethered.com/blog/posts/2025/google-jules-invisible-prompt-injection/ https://embracethered.com/blog/posts/2025/google-jules-invis...