zostera / django-marina / 35513084804

100%

push

github

Fail lint on invisible and bidirectional control characters (#680)

These characters do not render in a diff or a review, which is what makes
them useful for hiding code. Trojan Source (CVE-2021-42574) is the published
version of the attack: bidi overrides make source read one way to a human and
another to the compiler. Zero width spaces are the milder case, they just
creep into prose and never get noticed.

A security review of django-bootstrap5 found two zero width spaces in
docs/settings.rst, inherited from a 2014 commit and mirrored into
django-bootstrap3 and django-bootstrap4 when the docs were copied. Harmless
where they are, but nothing would have caught a harmful one.

The check is a git grep over tracked files, so it costs nothing and covers
every file type rather than just Python. If a character in the set is ever
genuinely needed, the recipe says to exclude its path and write down why.

Verified both ways: green on a clean tree, and it fails with the offending
line when a zero width space is planted.

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

28 of 28 branches covered (100.0%)

Branch coverage included in aggregate %.

164 of 164 relevant lines covered (100.0%)

14.0 hits per line