RESOLVED FIXED 238630
[Bugzilla] Code reviews show non-ASCII characters in patches as garbage 
https://bugs.webkit.org/show_bug.cgi?id=238630
Summary [Bugzilla] Code reviews show non-ASCII characters in patches as garbage
Myles C. Maxfield
Reported 2022-03-31 13:35:59 PDT
[Bugzilla] Code reviews show non-ASCII characters in patches as garbage
Attachments
Patch (1.45 KB, patch)
2022-03-31 13:37 PDT, Myles C. Maxfield 		no flags
DetailsFormatted DiffDiff
Patch (1.44 KB, patch)
2022-03-31 13:38 PDT, Myles C. Maxfield 		darin: review+
DetailsFormatted DiffDiff
Show Obsolete (1) View All Add attachment proposed patch, testcase, etc.
Myles C. Maxfield
Comment 1 2022-03-31 13:37:48 PDT
Created attachment 456274 [details] Patch
Myles C. Maxfield
Comment 2 2022-03-31 13:38:18 PDT
Created attachment 456275 [details] Patch
Myles C. Maxfield
Comment 3 2022-03-31 13:43:20 PDT
Committed r292170 (249077@trunk): <https://commits.webkit.org/249077@trunk>
Radar WebKit Bug Importer
Comment 4 2022-03-31 13:44:16 PDT
<rdar://problem/91123203>
mitz
Comment 5 2022-03-31 14:01:42 PDT
Is this a duplicate of bug 75394?
Alexey Proskuryakov
Comment 6 2022-03-31 19:42:21 PDT
I just realized that there is a downside to this change. Now our review page no longer serves as a defense against attacks like https://trojansource.codes. This seems fairly serious, perhaps we should undo it?
Myles C. Maxfield
Comment 7 2022-03-31 21:26:31 PDT
If we (the WebKit team) decide that we do need to take additional actions here (a conclusion which I don’t think is foregone), the action shouldn’t be to revert this patch thereby relying on accidental behavior. If we want to show certain characters as visible, we should do so by intentionally writing code to do it. If we do want a mitigation, we can surely find a middle ground where some Unicode characters are replaced but others aren’t.
Myles C. Maxfield
Comment 8 2022-03-31 21:31:25 PDT
(In reply to mitz from comment #5) > Is this a duplicate of bug 75394? It looks to me like “yes” but if that bug is still reproducing then maybe not?
Alexey Proskuryakov
Comment 9 2022-03-31 21:54:35 PDT
It doesn't seem worth the effort to develop any non-trivial mitigations, as pretty soon patch review will be on GitHub. But while it's here, it seems not great to create security risk.
Myles C. Maxfield
Comment 10 2022-04-01 10:28:08 PDT
*** Bug 75394 has been marked as a duplicate of this bug. ***
Myles C. Maxfield
Comment 11 2022-04-01 10:48:20 PDT
Does GitHub code review have mitigations for Trojan Source?
Myles C. Maxfield
Comment 12 2022-04-01 10:50:49 PDT
Looks like GitHub displays a message, e.g https://github.com/nickboucher/trojan-source/blob/eaca01d01bfd588d805fbc711c39a1b3679ac484/Python/commenting-out.py
Note You need to log in before you can comment on or make changes to this bug.