News for hackers. Stuff that matters.

A comment on ‘Trojan Source’ Bug Threatens the Security of All Code.

Re:‘Trojan Source’ Bug Threatens the Security of All Code by simmo9000 on Monday November 01, 2021 @01:14AM (#29063206)
Here is an example, open it in an appropriate editor (vi) and you can see how easy it is to 'exploit' (if you can call it that?).

https://github.com/nickboucher/trojan-source/blob/main/JavaS...

Seams like a layer 8 problem?

[ Parent | on HN ]
Re:‘Trojan Source’ Bug Threatens the Security of All Code by Semaphor on Monday November 01, 2021 @01:30AM (#29063287)
In case there are people who (currently) don’t have access to such an editor, here is a screenshot: https://i.imgur.com/2Ue2Vvd.png
[ Parent | on HN ]
Re:‘Trojan Source’ Bug Threatens the Security of All Code by brundolf on Monday November 01, 2021 @01:18AM (#29063228)
GitHub has already updated their UI I see
[ Parent | on HN ]
Re:‘Trojan Source’ Bug Threatens the Security of All Code by techsolomon on Monday November 01, 2021 @02:48AM (#29063718)
Changelog – https://github.blog/changelog/2021-10-31-warning-about-bidir...
[ Parent | on HN ]
Re:‘Trojan Source’ Bug Threatens the Security of All Code by Groxx on Monday November 01, 2021 @01:28AM (#29063281)
The Android app renders it much more suspiciously too, though unfortunately no warning: https://imgur.com/a/L3sNFQ8
[ Parent | on HN ]
Re:‘Trojan Source’ Bug Threatens the Security of All Code by siddhesh on Monday November 01, 2021 @04:58AM (#29064367)
You mean, like this?

https://imgur.com/a/unKuOoK

Snark aside, most text based editors have some giveaway or another. Even the GUI ones show syntax highlighting quirks that show that something is wrong.

This is only really relevant in unicode-aware terminals, without syntax highlighting and when you don't get to scroll between characters. IOW, it's really quite hard to do.

[ Parent | on HN ]