Bidirectional (BIDI) control characters can be used to reorder the display of source code, hiding malicious logic from human reviewers.
The Unicode encoding contains BIDI control characters that are used to display text right-to-left (RTL) instead of left-to-right (LTR). These characters can create a difference between what a human sees and what a compiler or interpreter executes. An adversary can use this to embed a backdoor in source code that will not be spotted by a human reviewer.
Hidden BIDI characters can disguise malicious code as benign, allowing backdoors to persist undetected. This can lead to supply chain attacks when the compromised code is included in libraries or shared projects.
A hidden BIDI character is present in the code, causing the displayed text to differ from the executed logic.
def subtract_funds(account: str, amount: int):
''' Subtract funds from bank account then ''' ;return
bank[account] -= amount
return
The executed code looks like the following:
def subtract_funds(account: str, amount: int):
''' Subtract funds from bank account then <RLI>''' ;return
bank[account] -= amount
return
def subtract_funds(account: str, amount: int):
''' Subtract funds from bank account then return; '''
bank[account] -= amount
return