Re: suggestion for checking unicode characters against "trojan source attacks"

[Jérémy Lal <kapouer@melix.org>]

Le ven. 5 nov. 2021 à 15:00, Felix Lechner <felix.lechner@lease-up.com> a écrit :

Dear Jérémy,

> > grep -r $'[\u061C\u200E\u200F\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069]'

Here are the results from the archive. [1] It's about half-way done.

Lintian shows which character was encountered, but there are lots of
false positives (all on contents). So far there are no hits on file
names.

Please help to identify classes of false positives. Otherwise, I have
to turn the tag into a classification (or disable it) which means we
won't see the results on the website. Thanks!

Awesome ! This is really cool. I've started fishing for exploits.

Most files indeed are just declaring unicode chars among others,

so i suppose the test needs to account for that fact.

As an example of an odd case, i don't understand why in

https://salsa.debian.org/multimedia-team/intel-media-driver/-/blob/master/media_driver/agnostic/common/os/mos_utilities.cpp#4351

We have those two characters u202D u202C:

    MOS_DECLARE_UF_KEY_DBGONLY(__MEDIA_USER_FEATURE_VALUE_MOCKADAPTOR_DEVICE_ID,
        "MockAdaptor Device ID",
        __MEDIA_USER_FEATURE_SUBKEY_INTERNAL,
        __MEDIA_USER_FEATURE_SUBKEY_REPORT,
        "MOS",
        MOS_USER_FEATURE_TYPE_USER,
        MOS_USER_FEATURE_VALUE_TYPE_INT32,
        "\u202D‭39497\u202C‬",

        "Device ID of mock device, default is 0x9A49"),

Any suggestion is welcome

 

Kind regards
Felix Lechner

[1] https://lintian.debian.org/tags/unicode-trojan