no_bidi_controls

Flag Trojan-Source bidi override characters (U+202A–202E, U+2066–2069). Defense against CVE-2021-42574.

Options

This rule takes no kind-specific options.

Plus the common paths, level, id, and when fields. This table is generated from the JSON Schema; option types and defaults are authoritative.

Example

A source file with a Trojan Source bidi override

The rule fires on this repository:

src/
src/clean.rs
src/sneaky.rs

src/clean.rs

pub fn ok() {}

src/sneaky.rs

let comment = "<U+202E>gnitcepsnI ydobon emah sih";

With this .alint.yml:

version: 1
rules:
  - id: no-bidi
    kind: no_bidi_controls
    paths: "src/**/*.rs"
    level: error

alint check reports:

--- src/sneaky.rs --------------------------------------------------------------
  x  error    no-bidi
              1:16  Unicode bidi control U+202E at line 1 col 16 (Trojan-Source
              defense)

Summary (1 violation):
  x 1 error
  0 passing * 1 failing

Source files with ordinary emoji and no bidi controls

This repository is compliant:

src/
src/ascii.rs
src/unicode.rs

src/ascii.rs

pub fn ok() {}

src/unicode.rs

// A ☃ comment with emoji 🦀
pub fn fine() {}

With this .alint.yml:

version: 1
rules:
  - id: no-bidi
    kind: no_bidi_controls
    paths: "src/**/*.rs"
    level: error

alint check reports:

v All 1 rule(s) passed.