3 ms·
Wasn't this basically a solved problem? My IDE is already using a font which visually distinguishes tabs from spaces, why isn't this "invisible code" being ren
by crote 8mo ago
Wasn't this basically a solved problem?
My IDE is already using a font which visually distinguishes tabs from spaces, why isn't this "invisible code" being rendered with the Unicode BMP Fallback font or the Unicode Last Resort font? Or, if you want to be very diligent, render everything which doesn't decode to a basic printable character like that, with a mouseover to view how it normally gets rendered.
I also don't understand the part about this being impossible to detect using static code analysis tools: isn't detecting things like weird Unicode literals pretty much the easiest task for a linter can do? Heck, even the "eval(Buffer.from(s('unicode magic')).toString('utf-8'))" decoder example would be completely trivial to detect with static code analysis - surely you're already throwing up massive warning flags on seeing an "eval"?
- nucleardog 8mo agoI tried to find any of the original text so I could try in my editor, but couldn't so I can't say for sure but... At least copying and pasting a bunch of unicode private use characters and stuff, they're not only rendered (box with an X through it) but highlighted in bright red. Presumably opening this file I'd see some suspicious looking code and a giant bright red block in the middle of it. I have the benefit that I'm only working in English so "flag anything that's not basic ASCII" is workable. I could see how this could get a bit messy when you _are_ working with other languages and need to differentiate the compound characters and invisible characters and things that _are_ part of your normal use versus these that aren't.