Control Characters In String

ID

go.control_chars_in_string

Severity

low

Remediation Complexity

trivial

Remediation Risk

low

Remediation Effort

low

Resource

Reliability

Language

Go

Tags

CWE:176, readability, reliability, unicode

Description

Reports a string literal whose source contains a raw control or zero-width (invisible) Unicode rune.

Rationale

Control characters and zero-width / directional format characters are invisible in most editors and code-review tools. Embedded raw in a string literal they silently change its value, and because no one can see them they are a common source of confusing bugs (a string that "looks right" but does not compare equal) and a known vector for hiding malicious differences in a review. Writing the same character as an explicit escape keeps the value identical while making it visible. The check flags only raw runes embedded directly in the source; an escaped control character is left alone, as are ordinary tab/newline whitespace in raw string literals.

var a = "Zero<U+200B>Width" // FLAW — a zero-width space is hidden in the literal
var b = "​"            // OK — written as an explicit escape, visible in source

Remediation

Replace the raw rune with its explicit escape (for example or \a), or remove it if it was pasted in by accident.