Skip to content

bug(security): bidi/format control characters can spoof the command shown in approval modals #1029

Description

@Juliusolsson05

Problem

Found in the #1026 review. The OpenCode permission modal now shows the command being approved, in full, inside a <pre>. The same applies to every surface that renders agent-proposed commands. Unicode bidi override and format characters (U+202A–U+202E, U+2066–U+2069, and zero-width characters) are reordered or hidden by the browser. This is the "Trojan Source" class, CVE-2021-42574: a prompt-injected model can make an executed command look different from what runs, for example making rm -rf appear commented out. Nothing in src/ neutralises these characters today.

Intended behaviour

Any approval surface renders these characters as visible escapes (e.g. ⟨U+202E⟩), so what the user sees is what runs. This covers the Claude and Codex permission and trust modals, the OpenCode modal, and composer previews. One shared helper should do it.

Acceptance

  • A renderer test drives the OpenCode permission modal from the recorded ask, reshaped to include U+202E, and asserts the override renders as a visible marker, not as reordering.
  • The same helper is used by every approval view.

OpenCode's own TUI has the same gap. It is still worth closing, because Agent Code's modal covers the feed where the tool call would otherwise be visible.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions