How can you be fooled by the U+202E trick? (2013)

Re:How can you be fooled by the U+202E trick? (2013) by chrismorgan on Wednesday February 16, 2022 @01:48AM (#30357023)

It should be noted that the problems of U+202E and such are not inherent to all Bidi_Control characters: Right-to-Left Marker, Left-to-Right Marker and Arabic Language Marker are all safe (and useful)—though UTR #36 suggests going far enough (e.g. “use only LTR or RTL, and if RTL, first and last characters must be strong”) that they wouldn’t be useful. It’s specific to the characters that override the default stuff, which means Embedding, Isolate and Override characters.

The Trojan Source paper has a decent treatment of the area too, seen in a different application: https://trojansource.codes/trojan-source.pdf.

[ Parent | on HN ]

Re:How can you be fooled by the U+202E trick? (2013) by phkahler on Wednesday February 16, 2022 @06:39AM (#30358747)

The problem seems to be that Unicode has gone a bit too far. No need to have the ability to do this.

[ Parent | on HN ]

Re:How can you be fooled by the U+202E trick? (2013) by dtech on Wednesday February 16, 2022 @08:15AM (#30359552)

The need seems quite obvious when mixing LTR and RTL languages, e.g. embed an American company or English phrase in a RTL language text.

[ Parent | on HN ]

Re:How can you be fooled by the U+202E trick? (2013) by phkahler on Wednesday February 16, 2022 @09:17AM (#30360223)

Why does it need to overwrite or obscure existing characters?

[ Parent | on HN ]

Re:How can you be fooled by the U+202E trick? (2013) by _nalply on Wednesday February 16, 2022 @04:03PM (#30365641)

The Right-To-Left Override (U+202E) does not obscure nor overwrite existing characters. It is an instruction to switch the text direction to right-to-left like for Arabic and Hebrew.

In the article it is shown how this can be misused to show executable files as a different file type:

    file[U+202e]fdp.exe shown as fileexe.pdf
        ~~~~~~~~^^^^^^^
           |       |--- read this right-to-left, i.e. exe.pdf     
           |----------- this is the Unicode character Right-To-Left Override

[ Parent | on HN ]

Re:How can you be fooled by the U+202E trick? (2013) by kazinator on Wednesday February 16, 2022 @06:08PM (#30367116)

It certainly obscures and overwrites. When you replace "fdp.exe" by "exe.pdf", you're obscuring and overwriting the leading "f" by "e", then the "d" by "x" and so on.

[ Parent | on HN ]

Re:How can you be fooled by the U+202E trick? (2013) by dtech on Thursday February 17, 2022 @03:52PM (#30378493)

It doesn't overwrite or obscure, it switches rendering direction. E.g. \u202E\u41\u42\u43 starts outputting from the right: \u41 from the right, then 42, then 43. That's CBA, altough in normal English you'd render that as ABC.

[ Parent | on HN ]