search

github / codeql

CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
https://codeql.github.com
MIT License
7.68k stars 1.54k forks source link

Implement queries to detect Trojan Source #7037

Open olivierlefloch opened 3 years ago

olivierlefloch commented 3 years ago

Does CodeQL have plans to implement automated detection of attempts to exploit the Trojan Source vulnerabilities that have been recently publicized?

https://krebsonsecurity.com/2021/11/trojan-source-bug-threatens-the-security-of-all-code/

For instance, it seems right now that CodeQL with security-and-quality enabled does not raise any issues on the proof of concept repository for this security research paper: https://github.com/nickboucher/trojan-source

KIT-GregC commented 3 years ago

Has this been implemented yet? This is extremely urgent.

tausbn commented 3 years ago

Thank you for your question!

We are currently working on figuring out how to best flag up these kinds of vulnerabilities (and indeed whether CodeQL is the right tool for this particular job).

Note that if a file contains one of these uses of bidirectional input, then GitHub already alerts the user to this fact as described on the GitHub blog here.

evankanderson commented 2 years ago

Is this still outstanding?

We'd like to be able to block code commits that include these characters; we're currently planning to maintain our own action, but would love to be able to roll this into codeql.