Skip to main content
I
Uni
UNICODE
Tools/BiDi & Trojan Source

Unicode BiDi & Trojan Source Security Studio

Analyze bidirectional text flow under Unicode Standard Annex #9 (UBA) and scan source code for invisible Trojan Source (CVE-2021-42574) control overrides in real time.

🛡️ No BiDi Attacks Detected
0Invisible Control Overrides
12Strong RTL (Urdu/Arabic)
38Strong LTR (Latin)
4Weak Digits / Numbers
Paragraph Layout Base Direction (HTML dir):
Quick Load Security & Mixed Presets:
Source Text / CodeReal-time BiDi Parser
Browser Visual Layout (dir="auto")
English text with RTL segment "مرحبا بالعالم" and 2026 numbers.

Logical Memory Codepoint Sequence & BiDi Type Stream Map

RTL LTR Number BiDi Override
EU+0045
nU+006E
gU+0067
lU+006C
iU+0069
sU+0073
hU+0068
U+0020
tU+0074
eU+0065
xU+0078
tU+0074
U+0020
wU+0077
iU+0069
tU+0074
hU+0068
U+0020
RU+0052
TU+0054
LU+004C
U+0020
sU+0073
eU+0065
gU+0067
mU+006D
eU+0065
nU+006E
tU+0074
U+0020
"U+0022
مU+0645
رU+0631
حU+062D
بU+0628
اU+0627
U+0020
بU+0628
اU+0627
لU+0644
عU+0639
اU+0627
لU+0644
مU+0645
"U+0022
U+0020
aU+0061
nU+006E
dU+0064
U+0020
2U+0032
0U+0030
2U+0032
6U+0036
U+0020
nU+006E
uU+0075
mU+006D
bU+0062
eU+0065
rU+0072
sU+0073
.U+002E

The Architecture of the Unicode Bidirectional Algorithm (UAX #9) & Trojan Source Attacks

Modern computer memory stores text as a strictly linear one-dimensional sequence of bytes (logical memory order). However, while Latin, Cyrillic, and Greek scripts read from Left-to-Right (LTR), Semitic and South Asian scripts (including Urdu, Arabic, and Hebrew) read from Right-to-Left (RTL).

To resolve the rendering of mixed-directional text, the Unicode Consortium established Unicode Standard Annex #9 (UAX #9: The Unicode Bidirectional Algorithm / UBA). Characters are classified into inherent directional categories:

Strong Types: L (LTR Latin), R (RTL Hebrew), AL (Arabic/Urdu letters).
Weak Types: EN (European digits), AN (Arabic-Indic digits), ES/CS (Signs/Separators).
Neutral Types: WS (Whitespace), ON (Other Punctuation & Symbols).
Explicit Controls: RLO (U+202E), LRO (U+202D), RLI (U+2067), LRI (U+2066).

In 2021, Cambridge University researchers disclosed the Trojan Source vulnerability (CVE-2021-42574 & CVE-2021-42694). Attackers insert invisible BiDi control characters inside source code comments or strings. While the code rendered in code editors and GitHub pull request reviews appears completely benign to human reviewers, the compiler executes the raw logical byte sequence — allowing attackers to bypass authentication gates without visual detection.

Key Security Controls & Fixes

  • CVE-2021-42574 Scanner: Instantly detects any presence of dangerous BiDi overrides in uploaded source code.
  • 1-Click Sanitizer: Automatically strips invisible override characters while preserving standard Arabic and Urdu letters.
  • Punctuation Drift Resolution: Explains how to insert Left-to-Right Mark (LRM U+200E) to fix closing brackets.
  • File Extension Spoofing Defense: Detects inverted extension attacks like invoice_\u202Ecod.exe.

Frequently Asked Questions (FAQs)

How does the Trojan Source attack execute different code than what is visually shown?+

Code editors render text visually according to the Unicode Bidirectional Algorithm (UAX #9). By injecting characters like RLO (U+202E) inside a comment, the closing comment delimiter "*/" is rendered visually before the comment, making executable code appear commented out to human eyes, while the compiler reads the raw byte stream in normal logical order.

Why does punctuation (like periods or parentheses) drift to the wrong side in Urdu or Arabic?+

Punctuation marks have a "Neutral" directional type in Unicode. When placed at the boundary between an RTL paragraph and an LTR sentence, the algorithm relies on weak context and may position the mark on the left instead of the right. Inserting an invisible Right-to-Left Mark (RLM U+200F) immediately fixes this.

Can compilers detect Trojan Source characters automatically?+

Modern versions of GCC, Clang, Rustc, and ESLint include warnings for unescaped bidirectional control characters (e.g. -Wbidi-chars). Our web tool allows instant detection without needing compiler toolchains.