CLI table library splits rare kanji in half due to Unicode surrogate pair bug

·1 views

A bug in the widely used cli-table3 JavaScript library caused a rare Japanese surname character, 𠮷 (U+20BB7), to be visually broken when displayed in terminal tables. The flaw resided in a one-line optimization that assumed a string was safe to cut by raw index whenever its UTF-16 code-unit length equalled its display width. The character 𠮷 is a surrogate pair, giving it a code-unit length of 2, and also an East Asian wide character, giving it a display width of 2 — two unrelated reasons that produce the same number, tricking the shortcut into firing. When the fast path sliced the string by index, it severed the surrogate pair, leaving a lone high surrogate that terminals render as a replacement box. Most common CJK characters avoid this branch entirely because their code-unit length and display width differ, meaning the bug only surfaces on this narrow class of supplementary-plane wide characters.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Real-World Prompt Injection Attack Nearly Hijacks Developer's AI Coding Agent

A developer recently reported that their AI coding agent was almost compromised by a prompt injection attack during an automated, unsupervised task. The malicious input attempted to override the agent's original instructions and redirect its behavior toward unintended actions. Unlike prompt injection in simple chatbots, attacks on coding agents carry far greater risk because these tools can execute code, access filesystems, make API calls, and interact with repositories. Security experts warn that AI agents cannot reliably distinguish between data they should process and instructions they should follow, making every external input a potential attack vector. Developers are urged to apply minimal privilege principles, treat external data sources as untrusted inputs, and maintain human oversight during agentic tasks.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Coding Agents Lack a Shared Workspace, Forcing Developers to Rebuild Context Repeatedly

Developers frequently lose accumulated project context—rules, decisions, and agent findings—each time they switch AI coding tools, because no persistent shared workspace exists across models. Current AI coding setups consist of chat windows, codebases, and IDE extensions, but nothing centrally holds the collective thinking or reasoning behind the code. When a new model is adopted, users must re-explain their entire project from scratch, since chat histories are siloed within individual tools and disappear when sessions close. A shared workspace—where multiple agents like Claude, ChatGPT, and Codex read from and write to a common source of truth—could eliminate redundant work and preserve continuity across sessions. The author states this gap is what their product, Memeri, aims to address, positioning it as a persistent workspace layer that sits above individual AI models.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Channels vs Mutexes in Go: How to Choose the Right Concurrency Tool

A technical guide for Go developers clarifies a commonly misunderstood concurrency proverb: 'share memory by communicating' is a design hint, not a strict rule. Mutexes are best when data stays in one place and multiple goroutines need guarded access, such as counters, caches, or connection pools. Channels are more appropriate when data moves from one owner to another, as in worker pools or pipelines, where a send effectively transfers ownership. A key pitfall highlighted is modifying data after sending it over a channel, which can cause data races since the sender no longer owns the underlying memory. The practical takeaway is to ask whether data 'stays put' or 'moves,' then choose the tool that matches that behavior.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Detect Honeypot Crypto Tokens Before Buying Using On-Chain Tools

Honeypot tokens allow purchases but block sellers through hidden contract conditions, making them one of the few crypto scams detectable before investing. Key red flags include high sell taxes, owner powers to pause or blacklist transfers, mintable supply, upgradeable proxy contracts, and deployer wallets with a history of scams. Free tools like honeypot.is and the GoPlus token security API can simulate trades and audit contract permissions without requiring an account. A Telegram bot called @RugLens_bot automates the entire checklist for both EVM and TON chains, returning a scored safety report within seconds. Analysts caution that a clean report rules out mechanical traps but does not guarantee a token is a sound investment, as developers can still dump holdings through legitimate contracts.

0 comments Read more at DEV Community