Gallery

Trojan Source

A single U+202E RIGHT-TO-LEFT OVERRIDE inside a comment reverses how the rest of the line is displayed. An editor shows the reader one thing; the interpreter reads another. Boucher and Anderson showed in 2021 that the same trick can hide an early return or flip an access check in nearly every language and code review tool (CVE-2021-42574). disclude reports any bidirectional control character in source as critical, and the page shows it as a visible marker.

Credit

Nicholas Boucher and Ross Anderson, Trojan Source (2021)

File

trojan_source.py (download)

Signals

1 critical · 0 warn · 0 info

Disclude version

4.3.0

Source

Hidden characters are shown as ⟨U+…⟩. Each signal below links to its line.

# Trojan Source style comment — the next line looks innocent but contains a RLO.access_level = "user"  # ⟨U+202E⟩ ;"admin" = level_access

Signals

Ordered by severity.

1. critical unicode-bidi trojan_source.py:2:26

   U+202E RIGHT-TO-LEFT OVERRIDE in source (raw pass, confidence 0.98)

   # Trojan Source style comment — the next line looks innocent but contains a RLO.
   access_level = "user"  # ⟨U+202E⟩ ;"admin" = level_access

Reproduce

Download the file and scan it. Copying it from this page won't work: the hidden characters are shown as markers.

cargo install disclude --version 4.3.0
curl -o trojan_source.py https://disclude.io/gallery/trojan-source/source
disclude scan --untrusted --severity info trojan_source.py