Remove bidirectional Unicode control characters (CVE-2021-42574) from locale format files

[Mohammed Ahmed Ghanam]

Trojan Source Vulnerability (CVE-2021-42574) in RTL Locale Files

Several RTL locale format files contain invisible Right-to-Left Mark (U+200F) characters, which are bidirectional Unicode control characters. This is a potential ​Trojan Source vulnerability that could be exploited to obfuscate malicious code.

Affected Files

File

Line

Character

Location

||django/conf/locale/ar/formats.py||10|2x U+200F|{{{|SHORT_DATE_FORMAT|}}|
||django/conf/locale/ckb/formats.py||11|1x U+200F|{{{|SHORT_DATETIME_FORMAT|}}|
||django/conf/locale/fa/formats.py||11|1x U+200F|{{{|SHORT_DATETIME_FORMAT|}}|

Example

Before (invisible RLM characters present):

SHORT_DATE_FORMAT = "d‏/m‏/Y"

After (cleaned):

SHORT_DATE_FORMAT = "d/m/Y"

Fix

Remove all bidirectional Unicode control characters from the affected files. The format strings remain functionally correct as the RLM characters are not needed for date/time formatting logic.

Patch attached.

[Mohammed Ahmed Ghanam]

Patch attached. Removes U+200F (RLM) characters from affected files.

[Sarah Boyce]

Trojan Source (CVE-2021-42574) concerns the use of bidirectional control characters to make source code appear different from the sequence of tokens interpreted by the compiler or interpreter. In this case, the U+200F characters are intentional contents of locale format string values, do not alter the interpretation of the Python source, and support correct rendering in right-to-left locales. See the Unicode CLDR date/time pattern guidelines for details: ​https://cldr.unicode.org/translation/date-time/date-time-patterns

If you believe you have identified a security issue in the future, please report it privately in accordance with Django's security policy rather than opening a public ticket: ​https://docs.djangoproject.com/en/dev/internals/security/#reporting-security-issues