Re: Trojan Source detection/highlight in Emacs?

[Eli Zaretskii]

> From: Skip Montanaro <skip.montanaro@gmail.com>
> Date: Mon, 1 Nov 2021 17:19:16 -0500
> 
> The recent Trojan Source vulnerability crossed my newsfeed a day or two
> ago.

For some value of "recent".

> IDEs, editors, and lint tools are probably where the bulk of the action
> will be. Has this been discussed within the Emacs developer community?

We had a long discussion of a very similar issue, in the context of
URLs and phishing.  It started here:

  https://lists.gnu.org/archive/html/emacs-devel/2014-11/msg02203.html

and continued into the next month:

  https://lists.gnu.org/archive/html/emacs-devel/2014-12/msg00004.html

As result of these discussions, I implemented a special function,
bidi-find-overridden-directionality, which is part of Emacs since
version 25.1, released 5 years ago.  (Don't rush to invoke that
function with the code samples mentioned above: it won't catch them.)
My expectation, and the reason why I bothered to write that function,
was that given the interest and the long discussion, the function will
immediately be used in some URL-related code in Emacs.  That didn't
happen, and the function is collecting dust in Emacs ever since.

Now, the code there is not ready for the kind of tricks these new
examples are playing, so it doesn't detect them.  It can be enhanced
to do that, though.  But I'm reluctant to invest my time and energy in
a feature that will just keep collecting dust.  So I will only work on
this if someone is actually prepared to use this function in Emacs by
adding some user-facing UI features, like making the problematic text
stand out on display, or displaying a warning.

I should also mention that Emacs has (weak) defenses against this kind
of tricks: we show the formatting control characters on display,
unlike other editors that hide them.  Also, cursor motion with C-f and
C-b will seem to behave erratically if you move across the problematic
text.  So users that actually look at the code they use will most
probably find out that something strange is going on (if they don't
look, no visual cue will do).