Repository navigation
Language-aware Trojan Source analysis and zero-install scan page - #112
Conversation
Comment and string roles now drive severity: bidi overrides in comments or strings are critical, matching identifier reordering. Lint infers language from the file suffix. autofix_trojan_source strips only bidi controls. Ship docs/scan.html (and scan.js copies) so fuckmark web can serve a browser reveal at /scan.html without uploading text. Freeze record v2 binds the new conformance vectors. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Team Run ID: Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f996908fab
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if _is_emojiish(prev_cp) or _is_emojiish(nxt_cp) or prev_cp in _VS or nxt_cp in _VS: | ||
| return CONTEXT_EMOJI |
There was a problem hiding this comment.
When a bidi control inside a recognized comment or string is adjacent to an emoji or variation selector (for example, //😀\u202e), this early return overrides the lexer role, classifying the finding as emoji and downgrading it to high. That contradicts the new language-aware behavior that treats bidi controls in comments and strings as critical Trojan Source encodings, and affects both lint and scan reports.
Useful? React with 👍 / 👎.
| return { | ||
| engine: "python", | ||
| total: inner.total || findings.length, | ||
| findings, | ||
| highest: inner.highest_severity || "", |
There was a problem hiding this comment.
When the local Python engine is selected and the input has more than 256 findings, /api/scan sets truncated and returns only the first 256 finding records, but this adapter discards that flag and renders the partial array as though it were complete. A bidi control placed after 256 other hidden characters is therefore not revealed, may be excluded from the displayed highest severity, and leaves “Fix Trojan Source” disabled because that button checks only this array; retain the truncation/count information or obtain all positions before presenting the result as complete.
Useful? React with 👍 / 👎.
Trojan Source bidi in a comment or string stays on that role even when the next glyph is emoji, so severity stays critical. Truncated Python /api/scan results now keep counts, the truncated flag, and peak severity across every hit, not only the first 256 listed findings. Freeze record v3 binds the new vectors. Co-authored-by: Byte271 <byte271@users.noreply.github.com>
2 participants
Continues the defensive scanner from #111 with the next slice: language-aware Trojan Source context plus a zero-install reveal page.
What this does
comment/string/ code roles. Language (auto, JavaScript/C-like, Python, SQL, HTML) picks comment syntax.//after:is not a comment (http://).#is a comment only forpython.autofix_trojan_source/autofixTrojanSourcestrip onlybidi_control.fuckmark lintinfers language from the file suffix, so// U+202Ein a.jsfile iscomment+critical.specs/fuckmark-hidden-scan-v1.*, including bidi beside emoji in comments/strings.docs/scan.html+docs/scan.js(same engine as the editor extension).fuckmark webserves/scan.html. Scanning runs in the browser; an optional local Python/api/scanconfirm appears when the CLI server is up. Examples are built withString.fromCodePointso the HTML file itself stays clean.Package version stays 0.4.1. Frozen confirmation artifacts are unchanged.
Review follow-up
Addressed the Codex P2s: bidi in a comment or string stays
criticaleven next to emoji; Python/api/scantruncation now keepstruncated, fullcounts, and peak severity across every hit (not only the first 256 listed findings).How to try it
Open
/scan.html, click Trojan Source identifier or Commenting-out, then Fix Trojan Source.Trojan Source identifier findings with U+202E badges
Commenting-out finding at critical comment context
scan_page_trojan_source_walkthrough.mp4
To show artifacts inline, enable in settings.