Re: Unicode confusables and reordering characters considered harmful

[Stefan Monnier]

> You cannot see those characters on a screenshot, for the same reason
> you cannot see any whitespace characters on a screenshot: they are
> only discernible when you move cursor through them.  Which is why I
> asked how are you looking for them.  If you are looking for them in a
> screenshot, you will never see them.

But that's the core of the vulnerability: if you just look at the screen
(and just scroll through it) you will have an incorrect understanding of
what the code does.

It's good that such bidi override chars are displayed as a thin space,
but it's mostly useful to make it possible to edit them (or to `C-x =`
on them), but I don't think it makes a significant different in terms of
the security issues introduced by the presence of those chars in the code.


        Stefan