Bidi Trojan Source Linter Bypassed in Format Strings

[brodieG]

This relates to the Trojan Source exploit.

I tried this code:

     println!("RLOhello world"); 

Where RLO are the raw bytes representing "\u202e" (or any of the other forbidden stateful bidi control characters) does not trigger the linter, whereas e.g.:

     let var = "RLOhello world";
     println!(var);

Does trigger the linter (as it should).

This was seen with:

$ rustc -V
rustc 1.61.0-nightly (1eb72580d 2022-03-08) 

I discussed this over e-mail with @pietroalbini and he recommended I post this as a regular issue since most editors / code review sites now handle the bidi stateful controls more gracefully than they did when the bidi trojan vulnerability was original disclosed.

[pietroalbini]

This was discussed with the Rust Security Response WG (not just me) and we agreed with making this issue public.