"Trojan Source" (CVE-2021-42574 and CVE-2021-42694): can 'guix lint' help someway?

[Giovanni Biscuolo]

Hello,

as probably many of you have discovered, today was announced two new
vulnerabilities that exploits the "bidirectional override" Unicode
codepoints feature, making it possible to hide malicious source code in
comments and literal strings /if/ the code review tool (e.g. editor)
does not show this.

The details are published here: https://www.trojansource.codes/

Also see related CVEs:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42574
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42694

I know that mitigations and patching of compilers and interpreters must
be done upstream and not much can be done by Guix, but I'm asking /if/
Guix could help code reviewers enhancing its lint function.

For example, the Rust security advisory for rustc [1] states:

--8<---------------cut here---------------start------------->8---

## Mitigations 

[...] If you can't upgrade your compiler version, or your codebase also
includes non-Rust source code files, we recommend periodically checking
that the following codepoints are not present in your repository and
your dependencies: U+202A, U+202B, U+202C, U+202D, U+202E, U+2066,
U+2067, U+2068, U+2069.

## Timeline of events 

* 2021-07-25: we received the report and started working on a fix. 
* 2021-09-14: the date for the embargo lift (2021-11-01) is communicated to us. 
* 2021-10-17: performed an analysis of all the source code ever published to 
crates.io to check for the presence of this attack. 
* 2021-11-01: embargo lifts, the vulnerability is disclosed and Rust 1.56.1 is 
released. 

--8<---------------cut here---------------end--------------->8---

Is there a way for "guix lint" to check for the listed (other?)
"dangerous" codepoints and warn code reviewers?

Is it possible for the Guix community to start a coordinated effort to
analyze all the source code (ever?!?) published in out git repo to check
for the presence of this attack?

AFAIU there is not much Guix can do for the "Homoglyph attacks"
(CVE-2021-42694).

WDYT?

Happi hacking! Gio'


[1] https://www.openwall.com/lists/oss-security/2021/11/01/1

-- 
Giovanni Biscuolo

Xelera IT Infrastructures

signature.asc
Description: PGP signature