Re: Unicode confusables and reordering characters considered harmful

[Stefan Kangas]

Vasilij Schneidermann <mail@vasilij.de> writes:

> There's a paper going around that demonstrates how two Unicode features
> can be used to trick source code auditors into misinterpreting program
> logic. The authors have suggested that language specifications should be
> amended, implementations should warn or raise errors and editor tooling
> should display visual warnings. Both issues are tracked as
> CVE-2021-42574 and CVE-2021-42694.

This is the list of solutions proposed on https://trojansource.codes/

(1) Compilers, interpreters, and build pipelines supporting Unicode should
    throw errors or warnings for unterminated bidirectional control
    characters in comments or string literals, and for identifiers with
    mixed-script confusable characters.

(2) Language specifications should formally disallow unterminated
    bidirectional control characters in comments and string literals.

(3) Code editors and repository frontends should make bidirectional control
    characters and mixed-script confusable characters perceptible with
    visual symbols or warnings.