Repository: microsoft/terminal
File: src/cascadia/TerminalControl/TermControl.cpp (C++)

Code before:
        _ReadOnlyChangedHandlers(*this, winrt::box_value(_core.IsInReadOnlyMode()));
    }

    // Method Description:
    // - Sets the read-only flag, raises event describing the value change
    void TermControl::SetReadOnly(const bool readOnlyState)
    {
        _core.SetReadOnlyMode(readOnlyState);
        _ReadOnlyChangedHandlers(*this, winrt::box_value(_core.IsInReadOnlyMode()));
    }

    // Method Description:
    // - Handle a mouse exited event, specifically clearing last hovered cell
    // and removing selection from hyper link if exists
    // Arguments:
    // - sender: not used
    // - args: event data
    void TermControl::_PointerExitedHandler(const Windows::Foundation::IInspectable& /*sender*/,
                                            const Windows::UI::Xaml::Input::PointerRoutedEventArgs& /*e*/)
    {
        _core.ClearHoveredCell();
    }

    // Attackers abuse Unicode characters that happen to look similar to ASCII characters. Cyrillic for instance has
    // its own glyphs for а, с, е, о, р, х, and у that look practically identical to their ASCII counterparts.
    // This is called a "IDN homoglyph attack".
    //
    // But outright showing Punycode URIs only is similarly flawed as they can end up looking similar to valid ASCII URIs.
    // xn--cnn.com for instance looks confusingly similar to cnn.com, but actually represents U+407E.
    //
    // An optimal solution would detect any URI that contains homoglyphs and show them in their Punycode form.
    // Such a detector however is not quite trivial and requires constant maintenance, which this project's
    // maintainers aren't currently well equipped to handle. As such we do the next best thing and show the
    // Punycode encoding side-by-side with the Unicode string for any IDN.
    static winrt::hstring sanitizeURI(winrt::hstring uri)
    {
        if (uri.empty())
        {
            return uri;
        }

        wchar_t punycodeBuffer[256];
        wchar_t unicodeBuffer[256];

        // These functions return int, but are documented to only return positive numbers.
        // Better make sure though. It allows us to pass punycodeLength right into IdnToUnicode.
        const auto punycodeLength = std::max(0, IdnToAscii(0, uri.data(), gsl::narrow<int>(uri.size()), &punycodeBuffer[0], 256));
        const auto unicodeLength = std::max(0, IdnToUnicode(0, &punycodeBuffer[0], punycodeLength, &unicodeBuffer[0], 256));

        if (punycodeLength <= 0 || unicodeLength <= 0)
        {

Review comment (suggestion):
```suggestion
    // This is called an "IDN homoglyph attack".
```

Code after:
        _ReadOnlyChangedHandlers(*this, winrt::box_value(_core.IsInReadOnlyMode()));
    }

    // Method Description:
    // - Sets the read-only flag, raises event describing the value change
    void TermControl::SetReadOnly(const bool readOnlyState)
    {
        _core.SetReadOnlyMode(readOnlyState);
        _ReadOnlyChangedHandlers(*this, winrt::box_value(_core.IsInReadOnlyMode()));
    }

    // Method Description:
    // - Handle a mouse exited event, specifically clearing last hovered cell
    // and removing selection from hyper link if exists
    // Arguments:
    // - sender: not used
    // - args: event data
    void TermControl::_PointerExitedHandler(const Windows::Foundation::IInspectable& /*sender*/,
                                            const Windows::UI::Xaml::Input::PointerRoutedEventArgs& /*e*/)
    {
        _core.ClearHoveredCell();
    }

    // Attackers abuse Unicode characters that happen to look similar to ASCII characters. Cyrillic for instance has
    // its own glyphs for а, с, е, о, р, х, and у that look practically identical to their ASCII counterparts.
    // This is called an "IDN homoglyph attack".
    //
    // But outright showing Punycode URIs only is similarly flawed as they can end up looking similar to valid ASCII URIs.
    // xn--cnn.com for instance looks confusingly similar to cnn.com, but actually represents U+407E.
    //
    // An optimal solution would detect any URI that contains homoglyphs and show them in their Punycode form.
    // Such a detector however is not quite trivial and requires constant maintenance, which this project's
    // maintainers aren't currently well equipped to handle. As such we do the next best thing and show the
    // Punycode encoding side-by-side with the Unicode string for any IDN.
    static winrt::hstring sanitizeURI(winrt::hstring uri)
    {
        if (uri.empty())
        {
            return uri;
        }

        wchar_t punycodeBuffer[256];
        wchar_t unicodeBuffer[256];

        // These functions return int, but are documented to only return positive numbers.
        // Better make sure though. It allows us to pass punycodeLength right into IdnToUnicode.
        const auto punycodeLength = std::max(0, IdnToAscii(0, uri.data(), gsl::narrow<int>(uri.size()), &punycodeBuffer[0], 256));
        const auto unicodeLength = std::max(0, IdnToUnicode(0, &punycodeBuffer[0], punycodeLength, &unicodeBuffer[0], 256));

        if (punycodeLength <= 0 || unicodeLength <= 0)
        {