Feat (Approvals): Warn on Invisible or Bidirectional Characters in Commands - #923
Open
z3roX882706 wants to merge 1 commit into
Open
Feat (Approvals): Warn on Invisible or Bidirectional Characters in Commands#923z3roX882706 wants to merge 1 commit into
z3roX882706 wants to merge 1 commit into
Conversation
…mands Command approval requests render the command string directly. Text can contain invisible controls or bidirectional overrides that make the visible rendering differ from the bytes that would run (a Trojan Source style spoof), so what the user sees is not necessarily what gets executed. Add a provider-independent display safeguard: when the approval command text contains invisible, control, or bidi-spoofing characters, show a warning above it so the user reviews the exact command before approving. - suspiciousCommandText.ts: pure detector (no shell parsing, no execution change) covering C0/C1 controls, DEL, zero-width, LRM/RLM/ALM, bidi embeddings/overrides/isolates, word joiner, and BOM. - InputController: render the warning ahead of the command description. - Focused unit tests for the detector. This does not interpret shell syntax or alter what runs; it only flags text whose appearance may not match its content. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Splitting the independently-useful piece out of #911 as suggested.
Command approval requests render the command string directly. That text can carry invisible controls or bidirectional overrides (Trojan Source style) so the visible rendering differs from what would actually run. This adds a provider-independent warning above the command when such characters are present, prompting the user to review the exact command before approving.
No shell parsing, no heuristic boundary, and no change to what executes: it only flags text whose appearance may not match its content.
Detector covers C0/C1 controls, DEL, zero-width, LRM/RLM/ALM, bidi embeddings/overrides/isolates, word joiner, and BOM.
Pure detector in its own module with focused unit tests.