Hidden unicode characters (Trojan Source)

[chschommer]

Hi,

in light of the recent "Trojan Source" publication about hidden Unicode control characters doing bad things, I checked how the Ace Editor handles this.

As you can see, you really can not see that something is wrong. Yes, the comment looks a little bit strange, but if you are someone who just copy and pastes scripts, you might not familiar with this.

We tried to show the hidden characters but this does not really improve the situation:

I wonder if it is possible to show the hidden Unicode characters with Ace. E.g., like Atlassian handles this now:

Is there any way to achieve this with the current version of Ace?

Thanks in advance!

[nightwing]

Do you have a list of such characters? Displaying them as red dots would be very easy. Displaying code the way Atlassian does will be harder but should be possible as well.

[chschommer]

Yes, there is a list. Red dots or something similar is an interesting idea. Basically an obvious hint that something is wrong/strange with the script. Obviously, there are legit cases for these characters in code. What I am more concerned of is copy&pasting code from the Internet or if someone sends you code that has been altered for bad causes.

Abbreviation	Code Point	Name	Description
LRE	U+202A	Left-to-Right Embedding	Try treating following text as left-to-right.
RLE	U+202B	Right-to-Left Embedding	Try treating following text as right-to-left.
LRO	U+202D	Left-to-Right Override	Force treating following text as left-to-right
RLO	U+202E	Right-to-Left Override	Force treating following text as right-to-left.
LRI	U+2066	Left-to-Right Isolate	Force treating following text as left-to-right without affecting adjacent text.
RLI	U+2067	Right-to-Left Isolate	Force treating following text as right-to-left without affecting adjacent text.
FSI	U+2068	First Strong Isolate	Force treating following text in direction indicated by the next character.
PDF	U+202C	Pop Directional Formatting	Terminate nearest LRE, RLE, LRO, or RLO.
PDI	U+2069	Pop Directional Isolate	Terminate nearest LRI or RLI.

[andrewnester]

Fixed by this PR and release in 1.15.0 version #4693