https://github.com/burberius/trojan-source-maven-plugin

Trojan Source Maven Plugin
https://github.com/burberius/trojan-source-maven-plugin

Last synced: about 1 year ago
JSON representation

Trojan Source Maven Plugin

• Host: GitHub
• URL: https://github.com/burberius/trojan-source-maven-plugin
• Owner: burberius
• License: apache-2.0
• Created: 2021-11-15T13:46:12.000Z (over 4 years ago)
• Default Branch: main
• Last Pushed: 2021-11-25T21:19:26.000Z (over 4 years ago)
• Last Synced: 2023-08-09T23:28:10.907Z (almost 3 years ago)
• Language: Java
• Size: 56.6 KB
• Stars: 1
• Watchers: 1
• Forks: 0
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# Trojan Source Maven Plugin

This Maven plugin scans your source code for occurrences of trojan source as described

on the following page: https://trojansource.codes

Trojan source attacks use unicode control characters to make evil source code look valid by

reordering parts of it. For a deeper explanation have a look on the above-mentioned page

or even read the paper of Nicholas Boucher and Ross Anderson, linked there.

The attack is also tracked by [CVE-2021-42574](https://nvd.nist.gov/vuln/detail/CVE-2021-42574).

## Add plugin to your project

To activate the plugin and let it scan the source code before compiling it,

just add the following section to your _pom.xml_ file:

```

  

    

      net.troja

      trojan-source-maven-plugin

      1.0

      

        

          mustache

        

        

          templates

        

        false

      

      

        

          

            scan

          

        

      

    

  

```

## Configration

### fileExtensions

Extra file extensions can also be scanned, which is very useful for example the

templates for code generation. For each entry add a _param_ tag.

### directories

Other directories than _src/main/java_ and _src/test/java_ can be included in

the scans with this configuration setting. For each entry add a _param_ tag.

### scanTests

By defaults the _src/test/java_ directory is also scanned, this can be switched

off by specifying _false_ in this tag.

## References

* Regular expression to scan for bidis was taken from https://github.com/nickboucher/bidi-viewer

* Example bidi file was taken from https://github.com/nickboucher/trojan-source