V5629. OWASP. Code contains invisible characters that may alter its logic. Consider enabling the display of invisible characters in the code editor.

The analyzer has detected characters in code that may confuse a developer. These characters can be invisible and change the way the code is displayed in IDEs. Combinations of such characters can cause a human and a compiler to interpret the code differently.

This can be done on purpose. This type of attack is called Trojan Source. Follow the links to learn more:

• Trojan Source attack for introducing invisible vulnerabilities;
• Trojan Source: Invisible Vulnerabilities.

The example:

bool isAdmin = false;
/*[RLO] } [LRI] if (isAdmin)[PDI] [LRI] begin admins only */ // (1)
  Console.WriteLine("You are an admin.");
/* end admins only [RLO]{ [LRI]*/                            // (2)

Look at line N1:

[LRI] if (isAdmin)[PDI]

The [LRI] character here applies up to the [PDI] character. The if (isAdmin) string is displayed left-to-right and is isolated. We get if (isAdmin).

[LRI] begin admins only */

The [LRI] character applies up to the end of the string. We get an isolated string: begin admins only */

[RLO] {space1}, '}', {space2}, 'if (isAdmin)', 'begin admins only */'

The [RLO] character applies to the end of the string and displays the text right-to-left. Each of the isolated strings previously obtained is treated as a separate, indivisible character. We get the following sequence:

'begin admins only */', 'if (isAdmin)', {space2}, '{', {space1}

Note. The closing brace character is now displayed as { instead of }.

The final view of the line N1 that can be displayed in the editor:

/* begin admins only */ if (isAdmin) {

Similar transformations apply to the line N2, which is displayed like this:

/* end admins only */ }

The code fragment that can be displayed in the editor:

bool isAdmin = false;
/* begin admins only */ if (isAdmin) { 
  Console.WriteLine("You are an admin.");
/* end admins only */ }

Reviewers may think that some check is done in the code before displaying the message. They ignore the comments and think that this is how the code should run:

bool isAdmin = false;
if (isAdmin) { 
  Console.WriteLine("You are an admin.");
}

However, there is no any check. This is how the discussed code looks for the compiler:

bool isAdmin = false;
Console.WriteLine("You are an admin.");

Look at a simple yet dangerous example of using invisible characters:

enum BlockCipherType { DES, TripleDES, AES };

BlockCipherType StringToBlockCipherType(string str)
{
    if (str == "AES[ZWSP]")
        return BlockCipherType.AES;
    else if (str == "TripleDES[ZWSP]")
        return BlockCipherType.TripleDES;
    else return BlockCipherType.DES;
}

The StringToBlockCipherType method converts the string to one of the BlockCipherType enumeration values. It looks like the method returns three different values, but it does not. Since an invisible space character [ZWSP] is added at the end of each string literal, equality checks with the AES and TripleDES strings will be false. As a result, the method will return only BlockCipherType::DES out of three expected values. At the same time, the code in the editor may look like this:

enum BlockCipherType { DES, TripleDES, AES };

BlockCipherType StringToBlockCipherType(string str)
{
    if (str == "AES")
        return BlockCipherType.AES;
    else if (str == "TripleDES")
        return BlockCipherType.TripleDES;
    else return BlockCipherType.DES;
}

If the analyzer issues a warning about invisible characters, enable the display of invisible characters in your editor. Ensure that they do not change the execution logic of the program.

This diagnostic is classified as:

Was this page helpful?

Message submitted.

Your message has been sent. We will email you at

If you do not see the email in your inbox, please check if it is filtered to one of the following folders:

• Promotion
• Updates
• Spam

If you can’t find an answer to your question, fill in the form below and our developers will contact you

By clicking this button you agree to our Privacy Policy statement