The Patching Friars' AlmanacA calendar of CVE saints

Patron of October 18

Trojan SourceHoly card for trojan-source, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 </> Trojan Source ORDO FALLIT OCULUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Trojan Source, Who Reorders the Characters

Patron of code reviewers, bidirectional Unicode characters, and everyone who trusts what they see on screen.

Life

On 18 October 2021 Nicholas Boucher and Ross Anderson of the University of Cambridge showed that Unicode control characters for bidirectional text could visually reorder source code: what the human read differed from what the compiler ran. Backdoors could thus be hidden in plain sight, invisible to the reviewer. The problem touched nearly every language at once, and compilers and editors rushed to warn about suspicious bidirectional characters.

Prayer

O Saint Trojan Source, who makes us read one thing and compile another, let our editors show us every hidden character. Amen.

How to celebrate

Celebrated by enabling bidirectional-character warnings in compiler and editor, and rereading the code byte by byte at least once.

Source is not what you see, but what the compiler reads.

Technical record

Disclosed on
October 18 2021
CVE
CVE-2021-42574CVE-2021-42694
CVSS
8.3

An issue was discovered in the Bidirectional Algorithm in the Unicode Specification through 14.0. It permits the visual reordering of characters via control sequences, which can be used to craft source code that renders different logic than the logical ordering of tokens ingested by compilers and interpreters. Adversaries can leverage this to encode source code for compilers accepting Unicode such that targeted vulnerabilities are introduced invisibly to human reviewers. NOTE: the Unicode Consortium offers the following alternative approach to presenting this concern. An issue is noted in the nature of international text that can affect applications that implement support for The Unicode Standard and the Unicode Bidirectional Algorithm (all versions). Due to text display behavior when text includes left-to-right and right-to-left characters, the visual order of tokens may be different from their logical order. Additionally, control characters needed to fully support the requirements of bidirectional text can further obfuscate the logical order of tokens. Unless mitigated, an adversary could craft source code such that the ordering of tokens perceived by human reviewers does not match what will be processed by a compiler/interpreter/etc. The Unicode Consortium has documented this class of vulnerability in its document, Unicode Technical Report #36, Unicode Security Considerations. The Unicode Consortium also provides guidance on mitigations for this class of issues in Unicode Technical Standard #39, Unicode Security Mechanisms, and in Unicode Standard Annex #31, Unicode Identifier and Pattern Syntax. Also, the BIDI specification allows applications to tailor the implementation in ways that can mitigate misleading visual reordering in program text; see HL4 in Unicode Standard Annex #9, Unicode Bidirectional Algorithm.

Sources: trojansource.codes

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.