Unicode BiDi & Trojan Source Security Studio
Analyze bidirectional text flow under Unicode Standard Annex #9 (UBA) and scan source code for invisible Trojan Source (CVE-2021-42574) control overrides in real time.
Logical Memory Codepoint Sequence & BiDi Type Stream Map
The Architecture of the Unicode Bidirectional Algorithm (UAX #9) & Trojan Source Attacks
Modern computer memory stores text as a strictly linear one-dimensional sequence of bytes (logical memory order). However, while Latin, Cyrillic, and Greek scripts read from Left-to-Right (LTR), Semitic and South Asian scripts (including Urdu, Arabic, and Hebrew) read from Right-to-Left (RTL).
To resolve the rendering of mixed-directional text, the Unicode Consortium established Unicode Standard Annex #9 (UAX #9: The Unicode Bidirectional Algorithm / UBA). Characters are classified into inherent directional categories:
U+202E), LRO (U+202D), RLI (U+2067), LRI (U+2066).In 2021, Cambridge University researchers disclosed the Trojan Source vulnerability (CVE-2021-42574 & CVE-2021-42694). Attackers insert invisible BiDi control characters inside source code comments or strings. While the code rendered in code editors and GitHub pull request reviews appears completely benign to human reviewers, the compiler executes the raw logical byte sequence — allowing attackers to bypass authentication gates without visual detection.
Key Security Controls & Fixes
- •CVE-2021-42574 Scanner: Instantly detects any presence of dangerous BiDi overrides in uploaded source code.
- •1-Click Sanitizer: Automatically strips invisible override characters while preserving standard Arabic and Urdu letters.
- •Punctuation Drift Resolution: Explains how to insert Left-to-Right Mark (
LRMU+200E) to fix closing brackets. - •File Extension Spoofing Defense: Detects inverted extension attacks like
invoice_\u202Ecod.exe.
Frequently Asked Questions (FAQs)
How does the Trojan Source attack execute different code than what is visually shown?+
Code editors render text visually according to the Unicode Bidirectional Algorithm (UAX #9). By injecting characters like RLO (U+202E) inside a comment, the closing comment delimiter "*/" is rendered visually before the comment, making executable code appear commented out to human eyes, while the compiler reads the raw byte stream in normal logical order.
Why does punctuation (like periods or parentheses) drift to the wrong side in Urdu or Arabic?+
Punctuation marks have a "Neutral" directional type in Unicode. When placed at the boundary between an RTL paragraph and an LTR sentence, the algorithm relies on weak context and may position the mark on the left instead of the right. Inserting an invisible Right-to-Left Mark (RLM U+200F) immediately fixes this.
Can compilers detect Trojan Source characters automatically?+
Modern versions of GCC, Clang, Rustc, and ESLint include warnings for unescaped bidirectional control characters (e.g. -Wbidi-chars). Our web tool allows instant detection without needing compiler toolchains.