Re: Unicode confusables and reordering characters considered harmful

[Eli Zaretskii <eliz@gnu.org>]

> From: Stefan Monnier <monnier@iro.umontreal.ca>
> Cc: Stefan Kangas <stefan@marxist.se>,  Eli Zaretskii <eliz@gnu.org>,
>   Clément Pit-Claudel <cpitclaudel@gmail.com>,
>   emacs-devel@gnu.org
> Date: Wed, 03 Nov 2021 08:20:01 -0400
> 
> I was more worried about the fact that, while highlighting those chars
> might be helpful to warn about accidental uses of them, if attackers
> want to trick the reader, I'm pretty sure they can get similar results
> without having to use those special LTR/RTL override chars:
> 
>     int hi = 5;
>     int שָׁלוֹם = hi;
>     int hello = 10;
>     int السّلامعليك = hello;
>     myfun(שָׁלוֹם ,السّلامعليكم)
> 
> There's no override here, but did I call `myfun` with args 5 and 10 or
> did I call it with args 10 and 5?

If we want, we can detect such cases as well.  It's quite easy,
actually, because the display engine has that information handy.