Re: Unicode confusables and reordering characters considered harmful, a simple solution

[Stefan Monnier <monnier@iro.umontreal.ca>]

>>      myfun("שָׁלוֹם" ,"السّلامعليكم");
> There is no danger in that example, and in particular nothing invisible.

I'm pretty sure an attacker can use the above confusing arg order to
turn an apparently harmless program into a security hole.

The fact that the args are passed in the other order than "expected" by
the naive reader means that the naive reader (who may very well be an
expert at computer security, reviewing potentially dangerous code, just
one who knows more about proofs&bits&bytes than about Unicode's
intricacies).


        Stefan