Trojan Source: code that lies to reviewers
Hidden text-direction characters can make code look harmless to a reviewer while the compiler sees something else.
Researchers at Cambridge published Trojan Source last week. They used Unicode direction control characters, the ones that let Arabic and Hebrew mix with English, to make source code display differently from how the compiler reads it. A reviewer sees a comment; the compiler sees code.
As someone who writes in Arabic and English every day, I find this one fascinating. The same characters that make right-to-left text work can hide logic.
What to do:
- Update your editors and code hosting. GitHub, GitLab and many editors now warn about these characters.
- Add a check in CI that rejects bidirectional control characters in source files, unless there’s a reason.
- Be extra careful with outside contributions and copied code.
Real Arabic text belongs in translation files and strings, not in the middle of logic.