Homoglyph identifier

The identifier раssword starts with two Cyrillic letters, р and а, that look exactly like Latin p and a. It is a different variable from password, which lets an attacker shadow a name, or slip a lookalike past review and search. The Trojan Source authors reported this as CVE-2021-42694. disclude names each lookalike character and the script it comes from.

Credit: Homoglyph attack, CVE-2021-42694 (Boucher and Anderson, 2021)
File: homoglyph.py (download)
Signals: 0 critical · 4 warn · 2 info
Disclude version: 4.3.0

Source

Hidden characters are shown as ⟨U+…⟩. Each signal below links to its line.

# Cyrillic "раssword" in an identifier name.раssword = "hunter2"print(раssword)

Signals

Ordered by severity.

warn unicode-homoglyph homoglyph.py:2:1

identifier `раssword` contains homoglyph candidates: р (0440)→p, а (0430)→a (raw pass, confidence 0.70)
```
# Cyrillic "раssword" in an identifier name.
раssword = "hunter2"
print(раssword)
```
warn unicode-mixed-script homoglyph.py:2:1

identifier `раssword` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
```
# Cyrillic "раssword" in an identifier name.
раssword = "hunter2"
print(раssword)
```
warn unicode-homoglyph homoglyph.py:3:7

identifier `раssword` contains homoglyph candidates: р (0440)→p, а (0430)→a (raw pass, confidence 0.70)
```
раssword = "hunter2"
print(раssword)
```
warn unicode-mixed-script homoglyph.py:3:7

identifier `раssword` mixes scripts: Cyrillic + Latin (raw pass, confidence 0.80)
```
раssword = "hunter2"
print(раssword)
```
info unicode-homoglyph homoglyph.py:1:13

identifier `раssword` contains homoglyph candidates: р (0440)→p, а (0430)→a (in string/comment) (raw pass, confidence 0.35)
```
# Cyrillic "раssword" in an identifier name.
раssword = "hunter2"
print(раssword)
```
info unicode-mixed-script homoglyph.py:1:13

identifier `раssword` mixes scripts: Cyrillic + Latin (in string/comment) (raw pass, confidence 0.40)
```
# Cyrillic "раssword" in an identifier name.
раssword = "hunter2"
print(раssword)
```

Reproduce

Download the file and scan it. Copying it from this page won't work: the hidden characters are shown as markers.

cargo install disclude --version 4.3.0
curl -o homoglyph.py https://disclude.io/gallery/homoglyph/source
disclude scan --untrusted --severity info homoglyph.py