Parser vulnerable to Trojan Source attack
- Dominant language
- F#
- Stars
- 4.3k
- Forks
- 876
- Avg merge
- 4d 11h
- Merged PRs (30d)
- 131
Description
Recently paper called [Trojan Source: Invisible Vulnerabilities](https://trojansource.codes/trojan-source.pdf) demonstrates an attack against source code. It uses Unicode bi-direcional overrides to misguide the meaning of code to a human reader.
**Repro steps**
```fsharp
let access_level = "user"
[]
let main _ =
if access_level <> "user (* Check if admin *)" then
printf "You are an admin.\n"
0
```
Only selecting text with mouse over condicional that is possible see some different thing.
[Here](https://sharplab.io/#v2:DYLgZgzgNALiBOBXAdlAJiA1AH2AUxgAIBDAY1LwggH18A3PYQgXkICJEI942BYAKAEBtADwBRZDHgBPAAoB7AJaSAfAF0B+IgFtiywtRYDChRWBLlKNeo0IiV7Tt0B0BIDMCQgAoAVIQDCACzxSAGtTc2I0bX0vAEpASwJXNkIYQORjE0IAB3hlGHM2AE15RBJ4PBJkEkjlADoAHWQ+fhMABiA=) I have an example to reproduce the problem
**Expected behavior**
Maybe compiler error which message `Invalid unicode character `
**Actual behavior**
`You are an admin.`
**Known workarounds**
I don't know
**Related information**
Crystal lang discussion about this: https://github.com/crystal-lang/crystal/issues/11392
Site about the problem: https://trojansource.codes/
Contributor guide
Assessment
This issue has not been assessed yet.