Skip to content

Conversation

@nifey
Copy link

@nifey nifey commented Dec 11, 2021

By using the Zero Width Space character between */ in line 5, we can comment lines beyond the current line with Bidi characters.

Interestingly, Github UI does not show the zero width space character in its warning.

@nickboucher
Copy link
Owner

@nifey This is brilliant! Thanks for posting this.

This is a fascinating variant of the attack, and I want to look deeper into what else can be done with this technique.

I'm going to test this against each of the languages that we're currently evaluating, and then will circle back with an accepted PR merge and likely some additional commits soon.

- Now only one line has Bidi control characters
- The Bidi characters are now terminated as well
@nifey
Copy link
Author

nifey commented Dec 13, 2021

Thanks @nickboucher , I have pushed a simplified version of the POC with Bidi overrides in only one line (instead of 2). Hope this is useful.

Actually, I cooked up some examples for a talk about Trojan source attacks that I gave in a meetup. Later realized that the example was slightly different than the commenting out variant given in the paper, since it comments out multiple lines and also cannot be detected by scanning for unterminated bidi overrides. So I thought of posting it here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants