Ua lomia e tagata su'esu'e mai le Iunivesite o Cambridge se metotia mo le fa'aofi le leoa o tulafono fa'aleaga i totonu o le fa'ailoga fa'apogai a tupulaga. O le auala osofaʻi saunia (CVE-2021-42574) o loʻo tuʻuina atu i lalo o le igoa Trojan Source ma faʻavae i luga o le faʻavaeina o tusitusiga e foliga ese mo le tuʻufaʻatasia / faʻamatala ma le tagata o loʻo matamata i le code. O faʻataʻitaʻiga o le metotia o loʻo faʻaalia mo le tuʻufaʻatasia ma faʻaliliuga eseese e tuʻuina atu mo C, C ++ (gcc ma clang), C #, JavaScript (Node.js), Java (OpenJDK 16), Rust, Go ma Python.
O le metotia e faʻavae i luga o le faʻaogaina o mataitusi Unicode faʻapitoa i faʻamatalaga faʻamatalaga e suia ai le faʻaaliga faʻasologa o tusitusiga e lua. Faatasi ai ma le fesoasoani a ia mataitusi pulea, o nisi vaega o tusitusiga e mafai ona faʻaalia mai le agavale i le taumatau, aʻo isi - mai le taumatau i le agavale. I faʻataʻitaʻiga i aso uma, e mafai ona faʻaogaina ia mataitusi faʻatonu, mo se faʻataʻitaʻiga, e faʻapipiʻi laina code i le gagana Eperu poʻo le Arapi i totonu o se faila. Ae afai e te tuʻufaʻatasia laina ma faʻatonuga tusitusiga eseese i le laina e tasi, e faʻaaoga ai mataitusi faʻamaonia, o fuaitau o tusitusiga o loʻo faʻaalia mai le taumatau i le agavale e mafai ona faʻapipiʻi tusitusiga masani o loʻo faʻaalia mai le agavale i le taumatau.
I le faʻaaogaina o lenei metotia, e mafai ona e faʻaopoopoina se faʻailoga leaga i le code, ae fai le tusitusiga ma lenei fausaga e le o vaaia pe a vaʻaia le code, e ala i le faʻaopoopoina i le faʻamatalaga o loʻo i lalo poʻo totonu o faʻamatalaga moni o loʻo faʻaalia mai le taumatau i le agavale, lea o le a taʻitaʻia atoatoa. 'ese'ese mata'itusi o lo'o fa'apipi'i i luga o le fa'aofi leaga. O ia fa'ailoga o le a tumau pea le sa'o, ae o le a fa'amatalaina ma fa'aalia ese.
A o toe iloiloina le code, o le a feagai le tagata atiae ma le faasologa vaaia o mataitusi ma o le a vaʻai i se faʻamatalaga e le masalomia i se tusitala o tusitusiga faʻaonapo nei, web interface poʻo le IDE, ae o le tuʻufaʻatasia ma le faʻaliliuga o le a faʻaogaina le faʻatonuga talafeagai o mataitusi ma o le a fa'agasolo le fa'aofi leaga e pei ona i ai, e aunoa ma le fa'alogo i le fa'asologa o tusitusiga i fa'amatalaga. O le faʻafitauli e aʻafia ai le tele o faʻasalalauga taʻutaʻua taʻutaʻua (VS Code, Emacs, Atom), faʻapea foʻi ma fesoʻotaʻiga mo le matamataina o code i faleoloa (GitHub, Gitlab, BitBucket ma oloa Atlassian uma).
E tele auala e faʻaoga ai le auala e faʻatino ai gaioiga leaga: faʻaopoopoina se faʻaaliga "toe foʻi" natia, lea e taʻitaʻia ai le maeʻa o le galuega i luma atu o le taimi; fa'ailoa mai o fa'amatalaga e masani ona va'aia o ni faugāfale fa'amaonia (fa'ata'ita'iga, fa'agata siaki taua); tu'uina atu isi fa'atauga manoa e o'o atu ai i le fa'amaoniaina o manoa.
Mo se fa'ata'ita'iga, e ono tu'uina atu e se tagata osofa'i se suiga e aofia ai le laina: if access_level != "user{U+202E} {U+2066}// Check if admin{U+2069} {U+2066}" {
lea o le a fa'aalia i totonu o le iloiloga e pei o access_level != “user” {/ // Siaki pe admin
E le gata i lea, o le isi osofaʻiga o loʻo faʻatulagaina (CVE-2021-42694), e fesoʻotaʻi ma le faʻaogaina o homoglyphs, mataitusi e foliga tutusa, ae eseese i le uiga ma e ese le unicode code (mo se faʻataʻitaʻiga, o le uiga "ɑ" e pei o le " a”, “ɡ” - “g”, “ɩ” - “l”). E mafai ona fa'aogaina mataitusi tutusa i nisi gagana i igoa o galuega ma fesuiaiga e fa'asesē ai tagata atia'e. Mo se faʻataʻitaʻiga, e lua galuega e iai igoa e le iloagofie e mafai ona faʻamalamalamaina e faia ai gaioiga eseese. A aunoa ma se auiliiliga auiliili, e le o manino mai po o fea o nei galuega e lua e valaauina i se nofoaga patino.
I le avea ai o se puipuiga malu, e fautuaina e tuʻufaʻatasia, faʻaliliu upu, ma meafaigaluega faʻapipiʻi e lagolagoina mataitusi Unicode e faʻaalia se mea sese poʻo se lapataiga pe a iai ni mataitusi e leʻi faʻaogaina i faʻamatalaga, manoa, poʻo faʻamatalaga e suia ai le itu o le gaosiga (U+202A, U+202B, U +202C, U+202D, U+202E, U+2066, U+2067, U+2068, U+2069, U+061C, U+200E ma U+200F). O ia mataitusi e tatau foi ona matua faʻasaina i faʻamatalaga faʻapolokalame gagana ma e tatau ona faʻaaloalogia i faʻatonu tulafono ma fesoʻotaʻiga fale teu oloa.
Fa'aopoopo 1: Ua saunia fa'ailoga vaivai mo le GCC, LLVM/Clang, Rust, Go, Python ma binutils. GitHub, Bitbucket ma Jira na faʻapipiʻiina foi le mataupu. O loʻo faʻagasolo le faʻaleleia mo GitLab. Ina ia iloa faʻafitauli faʻafitauli, e fautuaina e faʻaaoga le poloaiga: grep -r $'[\u061C\u200E\u200F\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069]/' puna
Faʻaopoopoga 2: Russ Cox, o se tasi o atinaʻe o le Fuafuaga 9 OS ma le Go programming language, na faitioina le tele o le gauai atu i le faʻamatalaga osofaʻiga auala, lea ua leva ona iloa (Go, Rust, C ++, Ruby) ma e leʻi manatu mamafa. . E tusa ai ma le Cox, o le faʻafitauli e masani lava ona faʻatatau i le faʻaalia saʻo o faʻamatalaga i faʻatonu tulafono ma fesoʻotaʻiga i luga o le upega tafaʻilagi, lea e mafai ona foia e ala i le faʻaaogaina o meafaigaluega saʻo ma code analyzers i le taimi o iloiloga. O le mea lea, nai lo le tosina atu i osofaʻiga faʻapitoa, e sili atu ona talafeagai le taulaʻi i le faʻaleleia atili o tulafono faʻavae ma le faʻalagolago i faiga.
E talitonu foi Ras Cox o tagata faʻapipiʻi e le o se nofoaga saʻo e foia ai le faʻafitauli, talu ai e ala i le faʻasaina o faʻailoga mataʻutia i le tulaga o le tuʻufaʻatasia, o loʻo i ai pea se vaega tele o meafaigaluega lea e tumau ai le taliaina o le faʻaogaina o nei faʻailoga, e pei o le fausiaina o faiga, assemblers, pule o pusa ma fa'aputuga eseese ma fa'amaumauga. Mo se faʻataʻitaʻiga, ua tuʻuina atu le poloketi Rust, lea na faʻasaina ai le faʻaogaina o le LTR / RTL code i le tuʻufaʻatasia, ae leʻi faʻaopoopoina se faʻapipiʻi i le pule o pusa uta uta, lea e mafai ai se osofaʻiga tutusa e ala i le faila Cargo.toml. E faapena foi, faila e pei ole BUILD.bazel, CMakefile, Cargo.toml, Dockerfile, GNUmakefile, Makefile, go.mod, package.json, pom.xml ma requirements.txt e mafai ona avea ma puna o osofaiga.
puna: opennet.ru