VNX-451: UI misrepresentation: hidden bidi controls in code, or a link that shows a different host

Detects Unicode bidirectional override/isolate controls written literally in source code (Trojan Source), and HTML/template links whose URL-looking text names a host unrelated to the href, or whose href hides the real host behind host-like userinfo before '@'.

Field	Value
Rule ID	`VNX-451`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Any file
CWE	CWE-451
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`ui-misrepresentation` `trojan-source` `phishing` `comments` `cwe-451`
Source	`internal/sast/rules/vnx-451.rego`

Overview

VNX-451 maps to CWE-451: User Interface (UI) Misrepresentation of Critical Information. The rule reports two concrete ways what a person reads differs from what the machine acts on:

Trojan Source (CVE-2021-42574). A bidirectional control character (U+202A to U+202E, U+2066 to U+2069) written literally in a source file. Editors and review diffs display the line reordered, so a comment or string appears to end where it does not and reviewers approve logic they cannot see. Comments and strings are where these hide, so this part reports comment lines too.
Misleading links. An anchor in an HTML or template file whose text reads as an address (a scheme, www. or host/path) for a host unrelated to the constant href’s host, or an href whose userinfo is itself a host name (https://bank.example@203.0.113.9/), so the real destination is hidden.

Not reported: escaped forms in sanitisers, literal controls only inside a regex character-class range that strips them, bidi marks in locale and data files (JSON, PO, YAML, XML), link text for the same host, a subdomain or parent domain, an href that contains the displayed host (archive links), dynamic hrefs or text, plain-word link text, links split over several lines, and HTML comments.

What Gets Flagged

<!-- FLAGGED: text shows the bank, link goes elsewhere -->
<a href="https://login.secure-verify.example.net/session">https://www.mybank.example/login</a>

<!-- FLAGGED: the host after '@' is the one the browser visits -->
<a href="https://www.mybank.example@198.51.100.20/statements">View statement</a>

// FLAGGED: a right-to-left override inside the comment reorders the line on screen
/*<U+202E> } <U+2066>if (isAdmin)<U+2069> <U+2066> only admins may delete */

Remediation

Remove bidi controls from code; write them as escape sequences where a string genuinely needs one, and enable the compiler or linter warnings for them.
Make visible link text match the destination, and never put userinfo in links shown to users.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-451
// nosec vnx-451

Or record an ignore rule: vulnetix ignore add --rule vnx-451 --reason "...". See Suppressing findings.