1738988 - Trojan source - CVE-2021-42574,CVE-2021-42694 - warns when used our code

Status: RESOLVED FIXED

(Developer Infrastructure :: Lint and Formatting, task)

Description

[Mike Hoye [:mhoye]]

In light of the fact that is now apparently possible to "hide" quite a lot of text in a visually non-detectable way in a file, by using Unicode BIDI and interlinear control characters.

https://www.trojansource.codes/

With that in mind, I'd like to propose an addition to our pre-compilation, pre-review step that either halts on or strips out Unicode BIDI and interlinear control characters from incoming patches.

We might also want to consider disallowing anything on the unicode "confusables" list from appearing anywhere but localization information.

Comment 1

[Andrew Halberstadt [:ahal]]

This might be possible to achieve via a "regex" linter. These aren't the most efficient (as they run a regex against every line of every file), but they are as simple to add as dropping in a YAML file like this one:
https://searchfox.org/mozilla-central/source/tools/lint/cpp-virtual-final.yml

If a slightly more complex or third party linter is needed, there are some docs on creating a new one here:
https://firefox-source-docs.mozilla.org/code-quality/lint/create.html

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Attachment: Bug 1738988 - Add support for trojan source detection in mozlint r?#linter-reviewers

Comment 3

[Sylvestre Ledru [:Sylvestre]]

Attachment: Bug 1738988 - mozlint: run trojan-source in the CI r?#linter-reviewers

Depends on D131086

Comment 4

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b7f9f5d76e60
Add support for trojan source detection in mozlint r=linter-reviewers,ahal DONTBUILD
https://hg.mozilla.org/integration/autoland/rev/bb07b9760564
mozlint: run trojan-source in the CI r=linter-reviewers,ahal DONTBUILD

Comment 5

[Alexandru Michis [:malexandru]]

https://hg.mozilla.org/mozilla-central/rev/b7f9f5d76e60
https://hg.mozilla.org/mozilla-central/rev/bb07b9760564