Heads up you code maintainers who take submissions from people, delete unicode characters.
-
@ChuckMcManis Is there any actual source for this with technical details? @dangoodin's article seems to just be citing the aikido.dev blog, which in turn reads like LLM slop puffery making up fake vulns to advertise their tools.
@ChuckMcManis @dangoodin In particular, the example text shown has no "invisible characters" in it, and PUA (*private* use area, not public) characters generally show up as a replacement character like � or a hex code, not a blank or much less zero-width glyph, unless you're using a font that assigns them for some particular use.
-
Heads up you code maintainers who take submissions from people, delete unicode characters. See this: https://arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/ Yes, people put back doors in code using unicode characters that don't show up on the screen. #infosec #foss #github
Yes, that crap has been going on since unscupulous entities figured out the chaos they could cause by using these characters.
-
Yes, that crap has been going on since unscupulous entities figured out the chaos they could cause by using these characters.
@labbatt50 And now they have LLMs that will generate code using only unicode characters.
-
@ChuckMcManis @dangoodin In particular, the example text shown has no "invisible characters" in it, and PUA (*private* use area, not public) characters generally show up as a replacement character like � or a hex code, not a blank or much less zero-width glyph, unless you're using a font that assigns them for some particular use.
@dalias @ChuckMcManis @dangoodin Judging by the decoder snippet, the string between the backticks contains U+FE00 VARIATION SELECTOR 1 to U+FE0F VARIATION SELECTOR 16, and U+E0100 to U+E01EF have more variation selectors for 17 to 256. So we can theoretically choose between 256 variants of an emoji!
https://en.wikipedia.org/wiki/Variation_Selectors_%28Unicode_block%29
-
@dalias @ChuckMcManis @dangoodin Judging by the decoder snippet, the string between the backticks contains U+FE00 VARIATION SELECTOR 1 to U+FE0F VARIATION SELECTOR 16, and U+E0100 to U+E01EF have more variation selectors for 17 to 256. So we can theoretically choose between 256 variants of an emoji!
https://en.wikipedia.org/wiki/Variation_Selectors_%28Unicode_block%29
@j0057 @ChuckMcManis @dangoodin It's possible there is some actual nefarious thing going on, but that Aikido's slopbot writing the blog just completely botched the explanation of it...
-
@j0057 @ChuckMcManis @dangoodin It's possible there is some actual nefarious thing going on, but that Aikido's slopbot writing the blog just completely botched the explanation of it...
@dalias @ChuckMcManis @dangoodin Calling `eval` on an apparently empty string being decoded is definitely suspicious and nefarious, it should never pass any decent code review.
-
@dalias @ChuckMcManis @dangoodin Calling `eval` on an apparently empty string being decoded is definitely suspicious and nefarious, it should never pass any decent code review.
@j0057 @ChuckMcManis @dangoodin Yeah, this looks like a complete non-issue.
-
Heads up you code maintainers who take submissions from people, delete unicode characters. See this: https://arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/ Yes, people put back doors in code using unicode characters that don't show up on the screen. #infosec #foss #github
Y'all are gonna force me to write a POC and then we'll all be in trouble.
-
@dalias @ChuckMcManis @dangoodin Calling `eval` on an apparently empty string being decoded is definitely suspicious and nefarious, it should never pass any decent code review.
I don't disagree with this, but how about calling eval() on a non-empty and innocuous string? Said string being only one or two regexes away from being not innocuous? How about your web service's json parameter list which when 'touched' by the magic regex has more parameters in it than you thought? People don't sanitize the strings that their own code sends them, and perhaps that is unwise.
-
Heads up you code maintainers who take submissions from people, delete unicode characters. See this: https://arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/ Yes, people put back doors in code using unicode characters that don't show up on the screen. #infosec #foss #github
@ChuckMcManis I'm curious to see a de-fanged example, so that I can see how Vim and Neovim display it, and also how it appears when run through `od -ax`.
-
I don't disagree with this, but how about calling eval() on a non-empty and innocuous string? Said string being only one or two regexes away from being not innocuous? How about your web service's json parameter list which when 'touched' by the magic regex has more parameters in it than you thought? People don't sanitize the strings that their own code sends them, and perhaps that is unwise.
@ChuckMcManis @j0057 @dangoodin Applying the mapping to it is super sus already, and even presence of eval at all is sus. I wouldn't accept a PR with eval without a detailed explanation of why it's not practical without eval.
-
@ChuckMcManis I'm curious to see a de-fanged example, so that I can see how Vim and Neovim display it, and also how it appears when run through `od -ax`.
@ChuckMcManis Also: What bozo thought it was a good idea to silently transcode the Public Use Area down to the ASCII range and then interpret it? Is this transcoding mandated by the Unicode standard, or just something "clever" they did on their own?
-
@labbatt50 And now they have LLMs that will generate code using only unicode characters.
Wasn't thinking. Absolutely, your right on the mark.
-
Heads up you code maintainers who take submissions from people, delete unicode characters. See this: https://arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/ Yes, people put back doors in code using unicode characters that don't show up on the screen. #infosec #foss #github
@ChuckMcManis back when Flickr was (written in Perl) built, Stewart Butterfield had a Unicode scanner on all user input. There’s an animal book where he describes the filter. I remember writing on in very slow Python calling inconv, (before Py handled UTF-8 unicode, PEP 3120). <https://www.yourtechstory.com/2024/08/15/stewart-butterfield-the-visionary-behind-flickr-and-slack/>
-
R relay@relay.infosec.exchange shared this topic
