Bidirectional controls, U+200E to U+2069

A family of invisible characters that control the direction text is laid out in: marks, embeddings, overrides and isolates. They tell a renderer to treat what follows as left-to-right or right-to-left, regardless of what the characters themselves imply.

How it works

These characters drive the Unicode bidirectional algorithm, which decides the visual order of characters that are stored in logical order. Marks such as U+200E and U+200F set the direction of neighbouring neutral characters. Embeddings and overrides, U+202A to U+202E, open a scope in which direction is forced, and U+202C closes it. Isolates, U+2066 to U+2069, do the same but prevent the scope from affecting text outside it. The security consequence follows directly from the design: an override can make the displayed order differ arbitrarily from the stored order, so a reviewer reading source code sees one sequence of statements while the compiler reads another. That technique has been catalogued and given a CVE. In text that runs in one direction throughout, these characters do nothing visible at all, and behave like any other invisible: breaking comparison, search and deduplication.

What it is legitimately for

Genuinely necessary in mixed-direction text. An Arabic sentence quoting an English product name needs help deciding how to lay out the punctuation between them.

What it breaks

• An override can make text display in an order completely different from the order it is stored in, so what you read is not what a program reads.
• That gap has been used to disguise filenames and source code, where a reviewer sees one thing and the compiler sees another.
• In ordinary single-direction text they do nothing visible and break comparison and search.

How to find it yourself

Look for the e2 80 8e through e2 81 a9 range in a hex dump. Any of them in text that is entirely one direction is suspicious.

What Clipboard Sanitizer does

Removed everywhere.