Re:‘Trojan Source’ Bug Threatens the Security of All Code
by wizzwizz4 on Monday November 01, 2021 @09:10AM
(#29066232)
Those Unicode characters aren't just there for show. They're part of real scripts that real people use; it would be annoying for people using those scripts.
Re:‘Trojan Source’ Bug Threatens the Security of All Code
by jhgb on Monday November 01, 2021 @09:14AM
(#29066261)
I'm fairly sure this could be arranged for. As in, if there's too many of them belonging to the character set of a particular language, then it's very likely that it's simply a text in that language. But random characters in the middle of ASCII identifiers are probably not something that you want.
Re:‘Trojan Source’ Bug Threatens the Security of All Code
by robotmay on Monday November 01, 2021 @09:24AM
(#29066350)
Yeah I'm not opposed to adding highlighting to them, and we are investigating how to do it, but it was less clear-cut than the bidi characters (which are totally invisible when rendered). I think we'll want to make it a bit more configurable and probably a separate option to the one which highlights the bidi characters.
Re:‘Trojan Source’ Bug Threatens the Security of All Code
by JoshTriplett on Monday November 01, 2021 @05:51PM
(#29073655)
Exactly. When we were adding support for non-ASCII identifiers to Rust, and thinking about homoglyphs and confusable characters, we needed to evaluate the tradeoffs between catching such characters and inconveniencing the speakers of various languages who want to write Rust in their language.
Re:‘Trojan Source’ Bug Threatens the Security of All Code
by R0b0t1 on Monday November 01, 2021 @02:54PM
(#29071225)
This type of attack isn't new. I can't recall the names but there are afair multiple C/C++ coding standards that limit everything to ASCII to avoid precisely this attack, but also others with visually similar but nonequivalent names.
Re:‘Trojan Source’ Bug Threatens the Security of All Code
by pas on Monday November 01, 2021 @02:23PM
(#29070771)
Yes, and they should be in well annotated/marked string/data sections, not in logic code.
Re:‘Trojan Source’ Bug Threatens the Security of All Code
by grishka on Monday November 01, 2021 @02:52PM
(#29071184)
Latin C and Cyrillic С aren't the same letter. The latter is actually an "s". It would be a pain in the ass to work with strings if those Cyrillic letters that look like their Latin counterparts reused their codepoints. Imagine having to convert "M" to lowercase. Would that return "m" or "м"? Same for "H", "h" or "н"?
And, actually, there was some really really cursed Soviet encoding that did this to save bits. The Russian railway company still uses it[1] to this day.
That actually strikes me as very desirable. (Especially in light of the old maxim that "programs must be written for people to read, and only incidentally for machines to execute".)