Source contains a zero-width or bidirectional Unicode control character
ID |
rust.maintainability.invisible_unicode_chars |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Readability |
Language |
Rust |
Description
Detects invisible Unicode characters in the source text - zero-width spaces and joiners, word joiners, the soft hyphen, the byte-order mark, and the bidirectional override and isolate controls - wherever they appear, including inside comments and string literals.
Rationale
These characters occupy no visual space, so the source a reviewer reads is not the source the compiler sees. Two identifiers or string constants that look identical can differ, and the bidirectional controls go further: they reorder how a line is displayed, so a comment or a condition can be shown in one order and compiled in another, which is the basis of the Trojan Source attack.
The following code illustrates the pattern detected by this rule:
pub fn identifiers() -> (&'static str, &'static str) {
// FLAGGED: Source contains a zero-width or bidirectional Unicode control character
let admin = "administrator";
// FLAGGED: Source contains a zero-width or bidirectional Unicode control character
let joined = "onetwo";
let plain = "administrator";
(admin, joined)
}