mcp-server-semgrep/semgrep-rules/generic/unicode/security/bidi.yml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: contains-bidirectional-characters
  patterns:
  - pattern-either:
    - pattern-regex: ‪             # left-to-right embedding (LRE)
    - pattern-regex: ‫             # right-to-left embedding (RLE)
    - pattern-regex: ‭             # left-to-right override (LRO)
    - pattern-regex: ‮             # right-to-left override (RLO)
    - pattern-regex: ⁦             # left-to-right isolate (LRI)
    - pattern-regex: ⁧             # right-to-left isolate (RLI)
    - pattern-regex: ⁨             # first strong isolate (FSI)
    - pattern-regex: ‬             # pop directional formatting (PDF)
    - pattern-regex: ⁩             # pop directional isolate (PDI)
  message: >-
    This code contains bidirectional (bidi) characters. While this is useful for support
    of right-to-left languages such as Arabic or Hebrew, it can also be used to trick
    language parsers into executing code in a manner that is different from how it
    is
    displayed in code editing and review tools.
    If this is not what you were expecting, please review this code in an editor that
    can reveal hidden Unicode characters.
  metadata:
    cwe:
    - "CWE-94: Improper Control of Generation of Code ('Code Injection')"
    category: security
    technology:
    - unicode
    references:
    - https://trojansource.codes/
    confidence: LOW
    owasp:
    - A03:2021 - Injection
    cwe2022-top25: true
    subcategory:
    - audit
    likelihood: LOW
    impact: HIGH
  languages:
  - bash
  - c
  - csharp
  - go
  - java
  - javascript
  - json
  - kotlin
  - lua
  - ocaml
  - php
  - python
  - ruby
  - rust
  - scala
  - sh
  - typescript
  - yaml
  severity: WARNING