TOB-FUEL-25: Invisible code points are supported in Sway programs

[xgreenx]

Description

The current sway parser allows any Unicode character in strings or comments, which can include invisible bidirectional override characters. Using such characters can lead to differences between the code reviewed in a pull request and the compiled code.

Figure 25.1: Sway program that logs “different”

script;
use std::string::String;
fn main() {
    let a = String::from_ascii_str("fuel");
    let b = String::from_ascii_str("fuel"); // Same string again
    if a.as_bytes() == b.as_bytes() {
        log("same");
} else {
        log("different");
    }
}

By default, VSCode shows the Unicode characters (figure 25.2). Google Docs, JetBrains CLion and GitHub display the source code as in figure 25.1. GitHub and JetBrains point out that bidi characters are present. GitHub shows by now a warning if bidi characters are present (see figure 25.3).

Figure 25.2: Code rendered using a non-bidi aware editor.

Figure 25.3: GitHub can also reveal the bidi characters.

Exploit Scenario

Figure 25.2: Code rendered using a non-bidi aware editor.
Figure 25.3: GitHub can also reveal the bidi characters.
An attacker creates a program that includes a backdoor, but hides the introduced bug using bidi Unicode characters. Review systems might not warn reviewers about the presence of bidi characters.

Recommendations

Short term, reject the following code points: U+202A, U+202B, U+202C, U+202D, U+202E, U+2066, U+2067, U+2068, U+2069. This list might not be exhaustive. Therefore, consider disabling all non-ASCII characters in the Sway language.
Long term, consider introducing escape sequences if not already done, so users can still use bidirectional code points if there is a legitimate use case.