The Invisible JavaScript Backdoor – Certitude Blog

A few months ago we saw a post on the r/programminghorror subreddit: A developer describes the struggle of identifying a syntax error resulting from an invisible Unicode character hidden in JavaScript source code. This post inspired an idea: What if a backdoor literally cannot be seen and thus evades detection even from thorough code reviews? Just as we were finishing up this blog post, a team at

[jay-es]

一見正しそうな空白文字や記号を使ったバックドアの例

[ledsun]

へー、面白い。韓国語（？）の見えない文字を変数名に使って、コードレビューを掻い潜ろうとする攻撃コード。