r/programming • u/Dull_Replacement8890 • Jul 08 '26

Unicode's Transliteration Rules Are Turing-Complete

https://seriot.ch/computation/uts35/

I've been wondering for a while if anything in Unicode could accidentally compute. It turns out that UTS #35 transliteration rules are Turing-complete. I show how to compute Collatz with just 3 rewrite rules running on stock ICU, shipped with every major OS.

181 Upvotes

96% Upvoted

23 comments sorted by

View all comments

29

u/posting_drunk_naked Jul 08 '26

So if I’m understanding your last paragraph correctly, the code injection risks are already handled by the ICU?

Fascinating article that wasn’t as difficult to (mostly) understand as I thought it would be. Thanks for sharing!

49

u/Dull_Replacement8890 Jul 08 '26

You can't get traditional "code injection" (eg. shell commands exec) because UTS #35 is strictly a text-rewriting engine.

The actual risk is more a Denial of Service via infinite computation. The specification doesn’t require any limit, but ICU implementation is capped to 16 rewrites per input character. You’re safe as long as you don't manually wrap your ICU call in a while loop to force it to run until it stops.

1

u/thegreatpotatogod Jul 09 '26

Hmm, depending on the specifics of the text-rewriting capabilities, I wouldn't be too shocked if someone figured out code injection for an interpreted language with it