Disallow isolate Unicode characters in comments and strings #13936
Labels
breaking change ⚠️
bug 🐛
low effort
There is not much implementation work to be done. The task is very easy or tiny.
medium impact
Default level of impact
must have eventually
Something we consider essential but not enough to prevent us from releasing Solidity 1.0 without it.
Milestone
Part of #10254.
Description
As shown in Security advisory for rustc (CVE-2021-42574), the isolate Unicode characters (LRI, RLI, FSI, PDI) can be used to take bit of text out of context and show it at the beginning or end of the line. We should disallow them to prevent this.
We have already disallowed unbalanced BiDi embedding/override characters in #10326. This is unfortunately not effective against the trick described here.
See How to use Unicode controls for bidi text for details on how these characters work.
The text was updated successfully, but these errors were encountered: