In a database table, I was running some phone number validations and I noticed that some unicode characters were inserted in a phone number field.
The characters are:
- (U+202C): Pop Directional Formatting
- (U+202D): Left-to-Right Override
The database cell is in the following format:
[U+202D]+35387123456789[U+202C]
I checked the other columns belonging to this entry and have come to the conclusion that they likely speak Arabic, which is written from right-to-left, meaning the user probably switched writing direction to enter their phone number and the system somehow stored these unicode characters.
I think my case is probably a false alarm, however I found that there are some exploits in Rust that use these characters.
Can anybody tell me if there is any risk of an exploit being executed using NodeJS/Sequelize/Postgres?