Right-to-Left Override: Filename Direction Trick
A filename containing the Unicode Right-to-Left Override character (U+202E) that reverses the visual display of the extension, making 'photo[RLO]gnp.exe' appear as 'photoexe.png'.
How This Attack Works
The Unicode RTLO character (U+202E) reverses the visual rendering direction of subsequent characters. Attackers insert it before a reversed dangerous extension, making the filename appear to have a safe extension. The actual file extension remains dangerous.
Attack Vector
File named 'report\u202Efdp.exe' displays as 'reportexe.pdf' in file managers. User sees .pdf extension and opens it. The actual extension is .exe.
Real-World Example
The Unitrix attack technique has been used by APT groups including Turla and APT28. It was also found in Telegram and WhatsApp file sharing vulnerabilities.
Safe Implementation
// SAFE: Strip bidirectional control characters
function sanitizeFilename(name: string): string {
return name.replace(/[\u200E\u200F\u202A-\u202E\u2066-\u2069]/g, '');
}Safe Handling Guidelines
Strip all Unicode bidirectional control characters (U+200E, U+200F, U+202A-U+202E, U+2066-U+2069) from filenames. Validate the actual byte-level extension, not the displayed name.