On Jul 23 2026, [email protected] wrote: > You're right that above 0x7F the *syntax* no longer forces a boundary -- > the boundary has to be chosen, and the question is which choice creates > the fewest problems downstream. "Everything" has three known ones: > > 1. Invisible characters. With ZWSP allowed, $Straße and > $Straße<U+200B> are two different variables that render > identically in every terminal and diff; an NBSP inside ${foo bar} > looks like a syntax error but isn't. This is the "Trojan Source" > class (CVE-2021-42574) that made GCC and Clang add warnings and > pushed every language that has revisited identifiers since toward > UAX #31 rather than anything-goes. Reviewability of shell scripts > is worth a lot; scripts are reviewed by eye more than most code.
What about confusables, like B vs. Β vs. В? > 2. Bidi format controls are also "not sh syntax", and allowing them > in names lets displayed order diverge from byte order in the > middle of a command line. Doesn't that issue also exist with Arabic and other right-to-left scripts, which (IIUC) can blend into neighboring bidi-neutral or bidi-mirroring characters? -- Andreas Schwab, [email protected] GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1 "And now for something completely different."
