TrojanSourceFinder v1.1.4 releases: detect “Trojan Source” vulnerability in source code

by do son · Published November 9, 2021 · Updated March 7, 2023

TrojanSourceFinder

TrojanSourceFinder helps developers detect “Trojan Source” vulnerability in source code.

Trojan Source vulnerability allows an attacker to make malicious code appear innocent. In general, the attacker tries to lure by passing his code off as a comment (visually). It is a serious threat because it concerns many languages. Projects with multiple “untrusted” sources could be concerned.

Detect Trojan Source

> Help the detection of Trojan source for manual code review or with CI/CD pipelines

To detect Trojan source in file or directory <path>:

tsfinder [path]

Go further (Homoglyph)

Trojan Source is not new and isn’t the only hazard. Another one is “Homoglyph”.(Kezako?)

tsfinder help detecting them with homoglyph command:

tsfinder homoglyph [filename] [flags]

You could see if there is a sibling (ie word with same “skeleton”) for the homographs found in path using the flag –sibling:

tsfinder homoglyph [filename] --sibling [path]

Functionality under development, depending on other projects

Visualize Trojan Source

> Visualize how the code is really interpreted by machines/compiler

tsfinder is deliberately not very verbose. By default, it will only output if the Trojan Source code has been detected. To have more verbosity and visualize the dangerous line add the flag -v

To better see where Trojan Source was you have for colored output with -c flag (also useful with directory scan):