Right-To-Left Override (RTLO) Spoofing
How attackers use the U+202E Unicode character to trick users into running executables disguised as documents.
The U+202E Character
The Right-to-Left Override character is designed to support text layout for languages like Arabic and Hebrew, forcing the subsequent text to be rendered right-to-left.
The Exploit
An attacker creates an executable file: budget_update_exe.doc.
They insert the RTLO character just before the "exe".
Filename: budget_update_[U+202E]cod.exe
The operating system's rendering engine (Explorer, Finder) sees the RTLO character and reverses the display of the subsequent characters ("cod.exe" becomes "exe.doc").
The user sees: budget_update_exe.doc and assumes it is a Word document. However, the OS file execution subsystem ignores rendering characters and executes the file based on its actual .exe extension.
Detection
Security software and modern email filters scan filenames specifically for this Unicode character to block spoofing attempts.
Common Mistakes
| Mistake | Consequence | Better Approach |
|---|---|---|
| FileReader.readAsArrayBuffer | Browser Crash (OOM) | Use File.slice for chunks |
| Rendering full DOM | Browser freeze | Virtualized list rendering |
FAQ
What is the max file size?
By using slicing and streams, we can handle files limited only by your OS filesystem (e.g., 2TB on NTFS), not your RAM.