Trojan Source Detector

This application detects Trojan Source attacks in source code. It can be used as part of the CI system to make sure there are no trojan source / unicode bi-directional text attacks in a pull request.

Usage

This utility can be used either on GitHub Actions:

jobs:
  trojansource:
    name: Trojan Source Detection
    runs-on: ubuntu-latest
    steps:
      # Checkout your project with git
      - name: Checkout
        uses: actions/checkout@v2
      # Run trojansourcedetector
      - name: Trojan Source Detector
        uses: haveyoudebuggedit/trojansourcedetector@v1

You can also run it on any CI system by simply downloading the released binary and running:

./trojansourcedetector

Configuration

You can customize the behavior by providing a config file. This file is named .trojansourcedetector.json by default and has the following fields:

Field	Description
directory	Directory to run the check on. Defaults to the current directory.
include	A list of files to include in the scan. Paths should always be written in Linux syntax with forward slashes and begin with the project directory. Basic pattern matching is supported via Go filepath. Defaults to empty (all files).
exclude	A list of files to exclude from the scan. Paths should always be written in Linux syntax with forward slashes and begin with the project directory. Basic pattern matching is supported via Go filepath. Defaults to .git and all its subdirectories.
detect_unicode	Alert for all non-ASCII unicode characters. Defaults to false.
detect_bidi	Detect bidirectional control characters. These can cause the trojan source problem. Defaults to true.
parallelism	How many files to check in parallel. Defaults to 10.

For an example you can take a look at the .trojansourcedetector.json in this repository.

If you want to use a different file name, you can change your GitHub Actions config:

jobs:
  trojansource:
    name: Trojan Source Detection
    runs-on: ubuntu-latest
    steps:
      # Checkout your project with git
      - name: Checkout
        uses: actions/checkout@v2
      # Run trojansourcedetector
      - name: Trojan Source Detector
        uses: haveyoudebuggedit/trojansourcedetector@v1
        with:
          config: path/to/config/file

Or, if you are using the command line version, you can simply pass the -config option with the appropriate config file.

Building

This tool can be built using Go 1.17 or higher:

go build cmd/trojansourcedetector/main.go

Running tests

In order to run tests, you will need to run the following two commands:

go generate
go test -v ./...