Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Glassworm is back: A new wave of invisible Unicode attacks hits repositories

aikido.dev

Post reply on HN
Print view View original

141–150 of 201 posts

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#141

Post by WalterBright »

ted_dunning wrote: post #130
WalterBright wrote: post #51

Earlier quoted context omitted.

> So you think that the letters in the Greek and Cyrillic alphabets which are printed identically to the Latin A should not exist? Yes. Unicode should not be about semantic meaning, it should be about the visual. Like text in a book. > And, for example, Greek words containing this letter should be encoded with a mix of Latin and Greek characters? Yup. Consider a printed book. How can you tell if a letter is a Greek l…

But these characters only look identical in some fonts. Are you saying that if you change font, some characters in a string should change appearance and others should not? And what about the round-trip rule? And ligatures? Aren't those a semantic distinction?

> But these characters only look identical in some fonts.

That's a problem with the fonts.

> And what about the round-trip rule?

Print Unicode on paper, then ocr it, and you'll get different Unicode. Oh, and normalization.

> ligatures

Generally an issue with rendering.

> semantic distinction

Unicode isn't about semantics (or shouldn't be). Consider 'a'. It's used for all kinds of meanings.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#142

Post by WalterBright »

Yokohiii wrote: post #119
WalterBright wrote: post #99

Earlier quoted context omitted.

> Unicode is about semantics not appearance. And that's where it went off the rails into lala land. 'a' can have all kinds of distinct meanings. How are you going to make that work? It's hopeless.

It already works. Tell me what the problem is and what your proposed solution would be.

Infer the meaning from the context.

    a) it's a bullet point
    b) a+b means a is a variable
    c) apple means a means the sound "aaaah"
    d) ape means a means the sound "aye"
    e) 0xa means a means "10"
    f) "a" on my test paper means I did well on it
    g) grade "a" means I bought the good bolts
    h) "achtung" means it's a German "a"
I didn't need 8 different Unicode characters. And so on.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#143

Post by WalterBright »

Yokohiii wrote: post #120
WalterBright wrote: post #110

Earlier quoted context omitted.

> While at it we could also unify I, | and l. It's too confusing sometimes. They render differently, so it's not a problem.

totally not true :D

Look again at its rendering!

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#144

Post by WalterBright »

slim wrote: post #131
WalterBright wrote: post #105

Earlier quoted context omitted.

Please explain why an invisible zero width "character" is necessary.

if you write كلب which is an arabic word written right to left in the middle of an english sentence, you want to preserve the order of the characters in the stream for computer processing purposes. meaning the chararacter ك must come before the ل and after the e and the space with respect to the memory layout. whereas when displayed, it must be inverted to be legible. the solution is to have an invisible character th…

Look I'm writing sdrawkcab (amazingly, I did it without using Unicode!). Layout is the job of your text formatting program. It's easy to fix a text editor to support right-to-left text entry.

The switch in text direction has resulted in malicious code injection attacks, as the reversed text becomes invisible. I had to change my compiler to reject those Unicode characters for that reason. It can be used in other cases to have hidden, malicious text.

Have you checked your SQL code for invisible backwards text that injects malware?

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#145

Post by WalterBright »

bawolff wrote: post #84
WalterBright wrote: post #21

Unicode should be for visible characters. Invisible characters are an abomination. So are ways to hide text by using Unicode so-called "characters" to cause the cursor to go backwards. Things that vanish on a printout should not be in Unicode. Remove them from Unicode.

Good luck with that given there are invisible characters in ascii. Also this attack doesnt seem to use invisible characters just characters that dont have an assigned meaning.

The only problematic one is CR which can be used to hide text on a glass terminal with a tty interface. I'd get rid of it if I could.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#147

Post by iririririr »

btown wrote: post #8

IMO while the bar is high to say "it's the responsibility of the repository operator itself to guard against a certain class of attack" - I think this qualifies. The same way GitHub provides Secret Scanning [0], it should alert upon spans of zero-width characters that are not used in a linguistically standard way (don't need an LLM for this, just n-tuples). Sure, third-party services like the OP can provide bots that…

specially because it's literally a problem with their code viewer (and vscode, which is also theirs).

i see squares on a properly configured vim on xterm.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#148

Post by WalterBright »

ted_dunning wrote: post #133
WalterBright wrote: post #25

Earlier quoted context omitted.

Spaces appear on a printout.

As do tabs, ems, ens and quads.

Unicode shouldn't be a typesetting language. The proper tool for that is Latex.

Re: Glassworm is back: A new wave of invisible Unicode attacks hits repositories

#149

Post by WalterBright »

krior wrote: post #137
WalterBright wrote: post #105

Earlier quoted context omitted.

Please explain why an invisible zero width "character" is necessary.

To mark linewrapping-breakpoints in strings.

Leave typesetting to a proper typesetting language, like Latex.
Post reply on HN