{% load djblets_utils i18n reviewtags %} {% definevar "CVE_2021_42574_URL" %}https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42574{% enddefinevar %} {% definevar "CVE_2021_42694_URL" %}https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42694{% enddefinevar %}
{% blocktrans with categories=warning_labels|humanize_list %} Invisible Unicode characters were found in this file that may be safe and intentional, or may be malicious, making code appear one way while executing another way. The following were found: {% endblocktrans %}
{# Bi-directional Unicode Characters #} {% if warning_ids|contains:'bidi' %}{% blocktrans %} Bi-directional Unicode characters may change the displayed order of code. For example, this safe-looking code: {% endblocktrans %}
{% code_block "c" %} if (access_level != "user") { // Check if admin {% end_code_block %}{% blocktrans %} ... may really be: {% endblocktrans %}
{% code_block "c" %} if (access_level != "user // Check if admin") { {% end_code_block %} {% endif %} {# Confusable/homoglyph Unicode Characters #} {% if warning_ids|contains:'confusable' %}{% blocktrans %} Characters were found that look like, but aren't the same as, ASCII characters common in function, class, or variable names. If used maliciously, they can change the behavior of code. For example: {% endblocktrans %}
{% code_block "javascript" %} // This uses an ASCII "A". function isAdmin() { ... } // This uses a Greek "Alpha". This may be a malicious function introduced elsewhere. if (isΑdmin()) { ... } {% end_code_block %} {% endif %} {# Zero-width Spaces #} {% if warning_ids|contains:'zws' %}{% blocktrans %} Zero-width spaces can make a malicious identifier (e.g., a function or variable) look like a valid one, or subtly change an important part of a string. For example, this safe-looking code: {% endblocktrans %}
{% code_block "python" %} bot_user = User.objects.get(username='service-bot'); bot_user.add_permissions('...') {% end_code_block %}{% blocktrans %} ... may really be closer to: {% endblocktrans %}
{% code_block "python" %} bot_user = User.objects.get(username='service-bot_'); bot_user.add_permissions('...') {% end_code_block %} {% endif %} {# Review notice/toggle button #}{% trans "Learn more about this vulnerability" %}
{% blocktrans %} You can toggle the display of these characters on and off. Lines containing these characters will be marked with a icon. {% endblocktrans %}