Control Characters In String
ID |
go.control_chars_in_string |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Reliability |
Language |
Go |
Tags |
CWE:176, readability, reliability, unicode |
Description
Reports a string literal whose source contains a raw control or zero-width (invisible) Unicode rune.
Rationale
Control characters and zero-width / directional format characters are invisible in most editors and code-review tools. Embedded raw in a string literal they silently change its value, and because no one can see them they are a common source of confusing bugs (a string that "looks right" but does not compare equal) and a known vector for hiding malicious differences in a review. Writing the same character as an explicit escape keeps the value identical while making it visible. The check flags only raw runes embedded directly in the source; an escaped control character is left alone, as are ordinary tab/newline whitespace in raw string literals.
var a = "Zero<U+200B>Width" // FLAW — a zero-width space is hidden in the literal
var b = "" // OK — written as an explicit escape, visible in source