git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: b4: unicode control characters -- warn or remove?

From
PMPavel Machek <pavel@ucw.cz>
Date
Nov 1, 2021, 20:49 UTC
Message-ID
<20211101204914.GA16445@duo.ucw.cz>
In-Reply-To
<20211101202220.dlcebvckeoz6c26k@meerkat.local>
Hi!
Show 24 quoted lines
> > It checks whitespace because that's something that's commonly a source
> > of patch corruption. I'm not adverse to adding this to core.whitespace,
> > but trying to catch malicious injected code seems like a rather big
> > expansion of its scope, particularly since:
> > 
> >     "[...]sending patches for docs actually written in RTL languages[...]"
> > 
> > Or just code? People write comment and even in their native languages,
> > and not all projects are as anglo-centric as those hosted on kernel.org.
> 
> My comment about docs was purely within the scope of the Linux kernel.
> 
> I think the following would be a sane check:
> 
> 1. are there unicode control characters (CCs) present?
> 2. are there other characters from RTL languages present in the same line?
> 
> if both 1 && 2 are true, this is a legitimate use of Unicode CCs. If only 1 is
> true, then it's likely worth a warning.
> 
> Maybe even relax #2 to just check for unicode characters above a certain
> barrier where RTL languages live. I think everyone will agree that if there
> are unicode CCs and no other unicode characters in that same line, it's likely
> not a legitimate use of control characters.

If you are worried about malicious patches, then it should be easy for attackers to add some RTL characters and escape the check...

Best regards,
								Pavel
-- 
http://www.livejournal.com/~pavelmachek
Previous: Konstantin RyabitsevNext: Konstantin Ryabitsev
Message 5 of 7 in “Re: b4: unicode control characters -- warn or remove?”
  1. Eric WongNov 1, 2021
  2. Konstantin RyabitsevNov 1, 2021
  3. Ævar Arnfjörð BjarmasonNov 1, 2021
  4. Konstantin RyabitsevNov 1, 2021
  5. Pavel MachekNov 1, 2021
  6. Konstantin RyabitsevNov 1, 2021
  7. Konstantin RyabitsevNov 2, 2021

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.