Skip to content

Disallow isolate Unicode characters in comments and strings #13936

Open
@cameel

Description

@cameel

Part of #10254.

Description

As shown in Security advisory for rustc (CVE-2021-42574), the isolate Unicode characters (LRI, RLI, FSI, PDI) can be used to take bit of text out of context and show it at the beginning or end of the line. We should disallow them to prevent this.

We have already disallowed unbalanced BiDi embedding/override characters in #10326. This is unfortunately not effective against the trick described here.

See How to use Unicode controls for bidi text for details on how these characters work.

Metadata

Metadata

Assignees

No one assigned

    Labels

    breaking change ⚠️bug 🐛low effortThere is not much implementation work to be done. The task is very easy or tiny.medium impactDefault level of impactmust have eventuallySomething we consider essential but not enough to prevent us from releasing Solidity 1.0 without it.

    Type

    No type

    Projects

    No projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions