Re: Invisible characters must be specified to be visible in security-sensitive situations

> Date: Thu, 15 Feb 2018 17:33:12 -0500
> From: Oren Watson via Unicode <unicode_at_unicode.org>
>
> https://securelist.com/zero-day-vulnerability-in-telegram/83800/
>
> You could disallow these characters in filenames, but when filename handling is charset-agnostic due to the
> extended-ascii principle this is impractical. I think a better solution is to specify a visible form of these
> characters to be used (e.g. through otf font variants) when security is of importance.

Emacs has a special function that searches a given region of a buffer
of text or of a text string for characters whose Bidi_Class property
has been overridden by RLO or LRO. Emacs application programs can use
this function to detect and flag such regions of text, and prevent
such malicious attacks.
Received on Fri Feb 16 2018 - 01:47:36 CST