V5340. OWASP. Code contains invisible characters that may alter its logic. Consider enabling the display of invisible characters in the code editor.

The analyzer has detected characters in code that may confuse a developer. These characters can be invisible and change the way the code is displayed in IDEs. Combinations of such characters can cause a human and a compiler to interpret the code differently.

In some cases, this is done intentionally. This type of attack is called Trojan Source. See the following articles for more details:

• Trojan Source attack for introducing invisible vulnerabilities;
• Trojan Source: Invisible Vulnerabilities.

Look at the following code snippet:

boolean isAdmin = false;
/*[RLO] } [LRI] if (isAdmin)[PDI] [LRI] begin admins only */ // (1)
  System.out.println("You are an admin.");
/* end admins only [RLO]{ [LRI]*/                            // (2)

Now, take a closer look at the (1) line:

[LRI] if (isAdmin)[PDI]

The [LRI] character here is valid up to the [PDI] character. The if (isAdmin) string is displayed left-to-right and is isolated. We get if (isAdmin).

[LRI] begin admins only */

The [LRI] character here is valid to the end of the string. We get the begin admins only */ isolated string.

[RLO] {space1}, '}', {space2}, 'if (isAdmin)', 'begin admins only */'

The [RLO] character here is valid to the end of the string and displays the text right-to-left. Each of the isolated strings obtained in the previous paragraphs is treated as a separate, indivisible character. We get the following sequence:

'begin admins only */', 'if (isAdmin)', {space2}, '{', {space1}

Note that the closing brace character is now displayed as { instead of }.

The final version of the (1) line that can be displayed in the editor:

/* begin admins only */ if (isAdmin) {

Similar transformations affect the (2) line, which is displayed like this:

/* end admins only */ }

The code fragment that can be displayed in the editor:

boolean isAdmin = false;
/* begin admins only */ if (isAdmin) { 
  System.out.println("You are an admin.");
/* end admins only */ }

A reviewer may think that some check is done in the code before displaying the message. They will ignore the comments and think that this is how the code should run:

boolean isAdmin = false;
if (isAdmin) { 
  System.out.println("You are an admin.");
}

However, there is no any check. This is how the code looks for the compiler:

boolean isAdmin = false;
System.out.println("You are an admin.");

Now, look at a simple yet dangerous example of using invisible characters:

enum BlockCipherType { DES, TripleDES, AES };

BlockCipherType getBlockCipherType(String cipherTypeName) {
  if (cipherTypeName.equals("AES[ZWSP]")) {
    return BlockCipherType.AES;
  } else if (cipherTypeName.equals("TripleDES[ZWSP]")) {
    return BlockCipherType.TripleDES;
  } else {
    return BlockCipherType.DES;
  }
}

The getBlockCipherType method converts the string to one of the BlockCipherType enumeration values. Looking at the code, one might conclude that the function returns three different values, but this is not the case. Due to the addition of an invisible [ZWSP] space character at the end of each string literal, equality checks with the AES and TripleDES strings will be false. As a result, the function will return only BlockCipherType.DES out of three expected values. At the same time, the code in the editor may look like this:

enum BlockCipherType { DES, TripleDES, AES };

BlockCipherType getBlockCipherType(String cipherTypeName) {
  if (cipherTypeName.equals("AES")) {
    return BlockCipherType.AES;
  } else if (cipherTypeName.equals("TripleDES")) {
    return BlockCipherType.TripleDES;
  } else {
    return BlockCipherType.DES;
  }
}

If the analyzer issued a warning about invisible characters in the code, enable the display of invisible characters in your editor and make sure that they do not change the execution logic of the program.

This diagnostic is classified as:

Was this page helpful?

Message submitted.

Your message has been sent. We will email you at

If you do not see the email in your inbox, please check if it is filtered to one of the following folders:

• Promotion
• Updates
• Spam

If you can’t find an answer to your question, fill in the form below and our developers will contact you

By clicking this button you agree to our Privacy Policy statement