The text, which is not

Text editors, and their main task is displaying a monospaced font (e.g., code), should, as the name implies, to show the characters the same width.

But there is a caveat

In Unicode, some characters to see which is not allowed. A text editor can simply render text with this character, and can take some action to make it visible.

Who are they?

the the the the the the the the the the

Code	Example	Name
U+2060	foobar	WORD JOINER
U+2061	foo⁡bar	FUNCTION APPLICATION
U+2062	foo⁢bar	INVISIBLE TIMES
U+2063	foo⁣bar	INVISIBLE SEPARATOR
U+180E	foo᠎bar	MONGOLIAN VOWEL SEPARATOR
U+200B	foobar	ZERO WIDTH SPACE
U+200C	foo's bar	ZERO WIDTH NON-JOINER
U+200D	foobar	ZERO WIDTH JOINER
U+FEFF	foobar	ZERO WIDTH NO-BREAK SPACE

Word joiner, U+2060

replaced the zero-width no-break space (U+FEFF), because U+FEFF was used for the encoding BOM (byte-order mark, a few bytes at the beginning of the file indicating the encoding and byte order). This symbol prohibits the transfer line where it is found.

Zero-width no-break space, U+FEFF

the Obsolete character, replaced by word joiner, was used for the same purpose.

Zero-width joiner, U+200D

Used in Indian and Arabic fonts for the unification of symbols, which without him would not be connected.

Zero-width non-joiner, U+200C

In the tracings with ligatures can be inserted between the letters to the ligature was not:

It is found even in the keyboards.

Zero-width space, U+200B

Used when it is necessary to designate a word boundary, without inserting a space. This text will be word wrapped

WordWordWordWordWordWordWordWordwordwordwordwordwordwordwordwordwordwordwordwordwordword

And this not:

WordWordWordWordWordWordWordWordwordwordwordwordwordwordwordwordwordwordwordwordwordword

Invisible Operators: function application U+2061 invisible times U+2062, invisible separator U+2063

"Invisible operators", added in Unicode 3.2. Need to refer to mathematical operations in expressions.

for Example, this notation: a_ij
Could be either the index (i, j) in a two-dimensional array, or index i*j one-dimensional. To disambiguate you can use either Invisible times Invisible separator or, to make it clear what was meant.

Similarly, f (x + y), or multiplication, or function.

Visually, they should not differ, but some parsers will be able to understand what was meant.

Mongolian vowel separator, U+180E

clear From the name what it's for. This symbol is not just caused problems. Very well described in this answer.

How it looks

of Course, displaying not only depends on the editor, but also from a font, look at the rendering of the text without changing the settings editors.

the Cat doesn't have them:

But if you run it with the option -A on linux or -v in macOS, almost all symbols are visible (thanks for the tip in comments):

the

cat-v invisibles.txt 
U+2060 foo?M-^A?bar WORD JOINER
U+2061 foo?M-^A?bar FUNCTION APPLICATION
U+2062 foo?M-^A?bar INVISIBLE TIMES
U+2063 foo?M-^A?SEPARATOR bar INVISIBLE
U+180E foo?M-^Nbar MONGOLIAN VOWEL SEPARATOR
U+200B foo?M-^@M-^Kbar ZERO WIDTH SPACE
U+200C foo?M-^@?M-^@?M-^@M-^Lbar ZERO WIDTH NON-JOINER
U+200D foo?M-^@M-^Mbar ZERO WIDTH JOINER
U+foobar FEFF ZERO WIDTH NO-BREAK SPACE

Vim also does not report about certain characters even with the included set list, but less is better:

Web

GitHub, so these characters appear in pull requests and diff Ah-Ah:

One popular code editor CodeMirror:

In the same CodeMirror used jsbin in IE a part of the character is visible:

ACE realizes that there is a baddie, and says that something is fishy here, but that's what it is — shows not always:

code Editors and diff tools

the Editors on the IntelliJ platform.

Miscellaneous tools code comparison under macOS (P4Merge, FileMerge, KDiff3):

KDiff3, the try is scored, but not enough.

SourceTree: does not handle text in any way, is bad:

Tortoise, also almost nothing:

git diff: good, showed everything, and allocated (although, in fact, made it less). Just fine for the diff tools is a role model:

Anguish: brainfuck, which is not found

Someone made a programming language Anguishusing only invisible characters. It is based on brainfuck, but uses punctuation and symbols, which we discussed above. There are even the interpreter Perl examples use.

Operation

Bad code fu to be, make a bookmark, very simple:

the

function f() {
// well, you know what to replace
return 'access_denined';
}
let code = f();
if (code === 'access_denied') {
return 401;
}

What to do

Write clean code, %username%. Follow best practices, they came up with, and to keep fewer things in mind, including the timely noticing such things. Saw a magical place, unusual or unverifiable default case, something else: you have time — do not be lazy, rewrite as necessary. Conduct code reviews, have a look at commitat in your turnips, keep up the good coverage. Remember that the string can be not only what is seen on the screen, check in hex editor, if there is a suspicion.

Generally, the probability of a backdoor via the invisible symbol, of course, but rather no than Yes: find it simply, but to insert a bookmark in the bad code and possible other methods.

Read

the

the
• Unicode Demystified A Practical Programmer's Guide to the Encoding Standard by Richard Gillam (you know where to look) — a good book about unicode, much discussed, including such characters

Article based on information from habrahabr.ru