dotnet / dotnet/fsharp

Parser vulnerable to Trojan Source attack

Open
#12,352 19 comments 3 reactions 0 assignees View on GitHub
Area-Compiler-Syntax Feature Request Tracking-External
Dominant language
F#
Stars
4.3k
Forks
876
Avg merge
4d 11h
Merged PRs (30d)
131

Description

Recently paper called [Trojan Source: Invisible Vulnerabilities](https://trojansource.codes/trojan-source.pdf) demonstrates an attack against source code. It uses Unicode bi-direcional overrides to misguide the meaning of code to a human reader.

**Repro steps**

```fsharp
let access_level = "user"

[]
let main _ =
if access_level <> "user‮⁦ (* Check if admin *)⁩⁦" then
printf "You are an admin.\n"
0
```

Only selecting text with mouse over condicional that is possible see some different thing.

[Here](https://sharplab.io/#v2:DYLgZgzgNALiBOBXAdlAJiA1AH2AUxgAIBDAY1LwggH18A3PYQgXkICJEI942BYAKAEBtADwBRZDHgBPAAoB7AJaSAfAF0B+IgFtiywtRYDChRWBLlKNeo0IiV7Tt0B0BIDMCQgAoAVIQDCACzxSAGtTc2I0bX0vAEpASwJXNkIYQORjE0IAB3hlGHM2AE15RBJ4PBJkEkjlADoAHWQ+fhMABiA=) I have an example to reproduce the problem

**Expected behavior**

Maybe compiler error which message `Invalid unicode character `

**Actual behavior**

`You are an admin.`

**Known workarounds**

I don't know

**Related information**
Crystal lang discussion about this: https://github.com/crystal-lang/crystal/issues/11392
Site about the problem: https://trojansource.codes/

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.