text
This way to user can choose if this is malicious or not by understanding what the actual characters are and possibly choose to enable the unicode algorithms to be able to read the text properly.
Thanks.
---
### Author:  [@martin](https://meta.discourse.org/u/martin)
#### Post date: [November 22, 2021, 10:30pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/3 "2021-11-22T22:30:32Z")
Thank you for raising this, we did think of this concern. The fix you linked in the OP only applies to unicode bidirectional characters in `pre` and `code` blocks, either manually written as HTML or generated from ````` markdown fenced code blocks, so it should not be an issue with regular Hebrew or Arabic text in a composed post.
---
### Author:  [@martin](https://meta.discourse.org/u/martin)
#### Post date: [November 22, 2021, 10:30pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/4 "2021-11-22T22:30:37Z")
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 22, 2021, 10:36pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/5 "2021-11-22T22:36:15Z")
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 22, 2021, 10:42pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/7 "2021-11-22T22:42:22Z")
Demo:
```plaintext
#include
int main() {
/* Say hello; newline*/ return 0 ;
printf("Hello world.\n");
return 0;
}
```
```
#include
int main() {
/* Say hello; newline*/ return 0 ;
printf("Hello world.\n");
return 0;
}
```
Test: “שלום חבר” - Hello Friend
Without BIDI
Test: “שלום חבר” - Hello Friend
Markdown:
```plaintext
Test: "שלום חבר" - Hello Friend
Without BIDI
Test: "שלום חבר" - Hello Friend
```
Not the best example in the world, but you should get the gist here, only impacts source code being posted on the forum. Bidi chars in source code is not something that is usually done.
---
### Author:  [@yaron](https://meta.discourse.org/u/yaron)
#### Post date: [November 23, 2021, 3:21pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/8 "2021-11-23T15:21:49Z")
I’ll give another example where no RLM does break the sentence.
שלום לכולם ובמיוחד ל־Sam, Martin בחר לעזוב אותנו.
שלום לכולם ובמיוחד ל־Sam, Martin בחר לעזוב אותנו.
Do you see the difference?
The only change there is RLM, I wanted to congratulate Sam and inform that Martin is leaving (No offense).
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 23, 2021, 8:16pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/9 "2021-11-23T20:16:44Z")
Yes, that example is certainly much better! As you can see it continues to work and is not impacted by the security fix 🎉
---
### Author:  [@yaron](https://meta.discourse.org/u/yaron)
#### Post date: [November 24, 2021, 1:27pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/10 "2021-11-24T13:27:07Z")
Hmmm it’s not a codeblock 🙂
I meant that inside a codeblock it won’t appear as expected (This is what the fix is all about, am I right?)
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 24, 2021, 9:39pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/11 "2021-11-24T21:39:18Z")
> [@yaron](#):
>
> I meant that inside a codeblock it won’t appear as expected
Yeah but why would you include it in a code block?
---
### Author:  [@yaron](https://meta.discourse.org/u/yaron)
#### Post date: [November 24, 2021, 9:56pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/12 "2021-11-24T21:56:54Z")
Excerpt from gettext, Hebrew/Arabic native strings, there are such cases.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 25, 2021, 1:47am UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/13 "2021-11-25T01:47:22Z")
> [@yaron](#):
>
> Excerpt from gettext,
I would the outlier case here has workarounds (screenshot, attachment uploads and so on), also it is pretty clear that the special char is in place.
The risk of [https://trojansource.codes/](https://trojansource.codes/) is higher than the risk of mild disruption in extreme outlier cases.
---
### Author:  [@yaron](https://meta.discourse.org/u/yaron)
#### Post date: [November 25, 2021, 5:47am UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/14 "2021-11-25T05:47:07Z")
But my suggestion breaks the sentence with some cue, so replacing the RLM and LRM with \ or \ will show the user that there were some additional characters and now the text is rendered without them yet informing that it might break the experience and that there’s an option to replace back manually if needed, removing the characters completely without some indicators gives no room for educated decisions.
And it will also prevent trojan source code as you mentioned because the user will be able to see the malicious code with the indicators.
I will try to get some screenshots from Pootle, I don’t remember seeing that raw strings option in the past couple of years, it was very useful when we started fixing the LibreOffice localization.
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 25, 2021, 6:10am UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/15 "2021-11-25T06:10:45Z")
Not following, we do not strip we replace , see my example above
---
### Author:  [@yaron](https://meta.discourse.org/u/yaron)
#### Post date: [November 28, 2021, 4:04pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/16 "2021-11-28T16:04:28Z")
I understand, wouldn’t it be better to use their names instead of Unicode entity?
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [November 28, 2021, 9:05pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/17 "2021-11-28T21:05:07Z")
If there is repeat confusion reported in the wild we can certainly fine tune
---
### Author:  [@system](https://meta.discourse.org/u/system)
#### Post date: [December 28, 2021, 9:05pm UTC](https://meta.discourse.org/t/bidirectional-characters-in-ltr-languages-post-security-fix/209819/18 "2021-12-28T21:05:19Z")
This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.