id	summary	reporter	owner	description	type	status	component	version	severity	resolution	keywords	cc	stage	has_patch	needs_docs	needs_tests	needs_better_patch	easy	ui_ux
37241	Remove bidirectional Unicode control characters (CVE-2021-42574) from locale format files	Mohammed Ahmed Ghanam	Mohammed Ahmed Ghanam	"= Trojan Source Vulnerability (CVE-2021-42574) in RTL Locale Files =

Several RTL locale format files contain invisible '''Right-to-Left Mark (U+200F)''' characters, which are bidirectional Unicode control characters. This is a potential [https://trojansource.codes Trojan Source] vulnerability that could be exploited to obfuscate malicious code.

== Affected Files ==

||'''File'''||'''Line'''||'''Character'''||'''Location'''||
|{{{|django/conf/locale/ar/formats.py|}}}|10|2x U+200F|{{{|SHORT_DATE_FORMAT|}}|
|{{{|django/conf/locale/ckb/formats.py|}}}|11|1x U+200F|{{{|SHORT_DATETIME_FORMAT|}}|
|{{{|django/conf/locale/fa/formats.py|}}}|11|1x U+200F|{{{|SHORT_DATETIME_FORMAT|}}|

== Example ==

Before (invisible RLM characters present):
{{{
SHORT_DATE_FORMAT = ""d‏/m‏/Y""
}}}

After (cleaned):
{{{
SHORT_DATE_FORMAT = ""d/m/Y""
}}}

== Fix ==

Remove all bidirectional Unicode control characters from the affected files. The format strings remain functionally correct as the RLM characters are not needed for date/time formatting logic.

Patch attached."	Bug	closed	Internationalization	6.0	Normal	invalid	bidi, unicode, security, CVE-2021-42574	Mohammed Ahmed Ghanam	Unreviewed	1	0	0	0	0	0