SDF Chatter
  • Communities
  • Create Post
  • Create Community
  • heart
    Support Lemmy
  • search
    Search
  • Login
  • Sign Up
DarkPlayer@lemmy.world to Programming@programming.dev · 1 year ago

Unicode tricks in pull requests: Do review tools warn us?

semanticdiff.com

external-link
message-square
18
fedilink
  • cross-posted to:
  • security@lemmy.ml
88
external-link

Unicode tricks in pull requests: Do review tools warn us?

semanticdiff.com

DarkPlayer@lemmy.world to Programming@programming.dev · 1 year ago
message-square
18
fedilink
  • cross-posted to:
  • security@lemmy.ml
In this blog post I take a look at how well GitHub, GitLab and Bitbucket support reviewers in finding malicious code changes in pull requests.
alert-triangle
You must log in or register to comment.
  • monk@lemmy.unboiled.info
    link
    fedilink
    arrow-up
    45
    ·
    1 year ago

    Homoglyphs? Invisible text? Bidirectional text? Just highlight every line that goes beyond ASCII with yellow warning colors and require to vet it. Maybe make localization data an exception.

    • cbarrick@lemmy.world
      link
      fedilink
      English
      arrow-up
      12
      ·
      1 year ago

      This doesn’t work for code bases written in non-English languages. Especially east asian languages.

      Any line containing an identifier that is also a word would be highlighted.

      More and more programming languages are supporting unicode identifiers for this use case.

      • mrkite@programming.dev
        link
        fedilink
        English
        arrow-up
        11
        ·
        1 year ago

        So it won’t work for 0.0001% of all github projects.

        • sndrtj@feddit.nl
          link
          fedilink
          arrow-up
          6
          ·
          1 year ago

          I’d suggest to have the occasional look at the “most popular repos” ranking. It’s about 50% Chinese.

          Super-interesting sometimes as it shows completely different tech trends.

        • cbarrick@lemmy.world
          link
          fedilink
          English
          arrow-up
          1
          ·
          1 year ago

          I know right.

          It’s wild that an American company primarily doing business in the West would have a bias towards English.

      • monk@lemmy.unboiled.info
        link
        fedilink
        arrow-up
        6
        ·
        1 year ago

        Yeah, just don’t. Allowing to code in anything other than English is a disservice, plain and simple.

        Inb4, I’m not being US-centric, Latin ain’t even my native alphabet.

      • MonkderZweite@feddit.ch
        link
        fedilink
        arrow-up
        1
        ·
        1 year ago

        deleted by creator

    • Actual@programming.dev
      link
      fedilink
      English
      arrow-up
      6
      ·
      1 year ago

      Very simple solution actually. Here I was thinking we’d need AI to solve it.

      • DudeDudenson@lemmings.world
        link
        fedilink
        arrow-up
        16
        ·
        1 year ago

        People would call that solution AI these days. If it has at least one if statement then they call it AI

      • slacktoid@lemmy.ml
        link
        fedilink
        English
        arrow-up
        3
        ·
        1 year ago

        We say we have AI to get VC funding

    • arthur@lemmy.zip
      link
      fedilink
      English
      arrow-up
      1
      ·
      1 year ago

      Or the non-ascii character itself.

      • monk@lemmy.unboiled.info
        link
        fedilink
        arrow-up
        3
        ·
        1 year ago

        Doesn’t work if it’s invisible.

        • xilophor@programming.dev
          link
          fedilink
          arrow-up
          1
          ·
          1 year ago

          what about a box around it?

  • snowe@programming.devM
    link
    fedilink
    arrow-up
    15
    ·
    1 year ago

    Website really struggled on mobile. Anytime I swipe to view the longer code lines in the code blocks it would open the sidebar. Very annoying.

    • superbirra@lemmy.world
      link
      fedilink
      arrow-up
      3
      ·
      1 year ago

      yeah I also hated it

    • ReluctantMuskrat@lemmy.world
      link
      fedilink
      arrow-up
      2
      arrow-down
      1
      ·
      1 year ago

      Had no trouble here on mobile.

      • superbirra@lemmy.world
        link
        fedilink
        arrow-up
        1
        arrow-down
        1
        ·
        1 year ago

        thank you for letting us know? :)

    • MonkderZweite@feddit.ch
      link
      fedilink
      arrow-up
      1
      ·
      1 year ago

      deleted by creator

  • ck_@discuss.tchncs.de
    link
    fedilink
    arrow-up
    11
    arrow-down
    1
    ·
    1 year ago

    TL;DR: you could adopt good programming practices like “don’t shadow mutable state” and “put constants first in a comparison” or you can pay us money so we show you obscure attempts to exploit your bad programming in code review … maybe …

  • hh93@lemm.ee
    link
    fedilink
    arrow-up
    4
    arrow-down
    1
    ·
    1 year ago

    Very interesting read

Programming@programming.dev

programming@programming.dev

Subscribe from Remote Instance

Create a post
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !programming@programming.dev

Welcome to the main community in programming.dev! Feel free to post anything relating to programming here!

Cross posting is strongly encouraged in the instance. If you feel your post or another person’s post makes sense in another community cross post into it.

Hope you enjoy the instance!

Rules

Rules

  • Follow the programming.dev instance rules
  • Keep content related to programming in some way
  • If you’re posting long videos try to add in some form of tldr for those who don’t want to watch videos

Wormhole

Follow the wormhole through a path of communities !webdev@programming.dev



Visibility: Public
globe

This community can be federated to other instances and be posted/commented in by their users.

  • 177 users / day
  • 1.37K users / week
  • 3K users / month
  • 7.18K users / 6 months
  • 311 local subscribers
  • 20.2K subscribers
  • 2.22K Posts
  • 34.8K Comments
  • Modlog
  • mods:
  • snowe@programming.dev
  • Ategon@programming.dev
  • MaungaHikoi@lemmy.nz
  • UlrikHD@programming.dev
  • BE: 0.19.8
  • Modlog
  • Instances
  • Docs
  • Code
  • join-lemmy.org