5 ms·
> The invisible code is rendered with Public Use Areas (sometimes called Public Use Access), which are ranges in the Unicode specification for special character
by ErroneousBosh 8mo ago
> The invisible code is rendered with Public Use Areas (sometimes called Public Use Access), which are ranges in the Unicode specification for special characters reserved for private use in defining emojis, flags, and other symbols. The code points represent every letter of the US alphabet when fed to computers, but their output is completely invisible to humans. People reviewing code or using static analysis tools see only whitespace or blank lines. To a JavaScript interpreter, the code points translate into executable code.
Surely the obvious answer is just to strip anything in that Unicode range out?
Why have you even got Unicode in your source anyway?
- zihotki 8mo agoObviously, unicode is used in sources so that we can enjoy those nice and cool emojis in our code and readme's! /s
- crote 8mo ago> Why have you even got Unicode in your source anyway? Because not everyone uses English as their only language? If you're a Japanese software company writing code for Japanese companies encoding Japan-specific business logic, you probably want to write your comments in Japanese. And even if you write those in English, you definitely need to embed Japanese strings to be displayed to the end user.
- ErroneousBosh 8mo agoYou should not have text strings hardcoded into your binary in a way that they can be treated as executable code.
- crote 8mo agoObviously, but that wasn't your question.
- deleted 8mo ago[deleted]