← All sheets
GL-S-040Sheet 040FOR INFORMATIONS · SECURITY

Code that reads one way and compiles another.

DETAIL · TROJAN SOURCE · CODE REVIEW · CVE-2021-42574

Drawing sheet 040: Code that reads one way and compiles another.

General notes

  1. 01Unicode has control characters that flip text direction. Hide one in a comment and the editor shows one program while the compiler sees another.
  2. 02Published in 2021 as "Trojan Source". It still works wherever a reviewer trusts their eyes.
  3. 03Defence is boring and effective: strip bidi controls at the boundary, in review tooling and in anything that ingests documents.
5Detail · the control charactersStrip on ingest
U+202A … U+202E   embedding and override controls
U+2066 … U+2069   isolate controls
U+E0000 … U+E007F  invisible tag characters (see sheet 007)

As posted

Code that reads one way and compiles another.

Unicode has characters that flip text direction. Hide one in a comment: the editor shows one program, the compiler another.

Trojan Source, 2021. Still works on anyone who trusts their eyes.

Strip them at the boundary. Sheet 040.

Read with

  • Sheet 007 · That PDF has characters you can't see. The model can.
  • Sheet 013 · In a RAG pipeline, the document is the attacker.