Boucher & Anderson, 2021 - trojan-source.pdf · CVE-2021-42574
The YAML post showed invisible Unicode corrupting config files. Trojan Source is the same class of problem, escalated into source code.
Unicode BIDI (bidirectional) control characters exist to support mixing right-to-left scripts - Arabic, Hebrew - with left-to-right text. In source code, an attacker can use them to flip how an editor displays tokens without changing the logical byte order the compiler sees. Reviewer and compiler read different programs. The paper demonstrates three attack shapes: hiding a live return inside what looks like a comment, making real code appear commented-out, and stretching string boundaries to swallow surrounding logic.
Go is technically susceptible - the compiler and go vet ignore BIDI characters entirely. But the ecosystem has responded.
The guardrails
GitHub added visual warnings for BIDI control characters in source and diffs after this paper dropped. A commit carrying these characters surfaces the affected lines in code review before anything merges.
golangci-lint ships a bidichk linter that flags dangerous BIDI sequences in Go source files. If you run golangci-lint in CI, this is caught automatically - no manual grep required.
The paper’s core observation still holds: the language doesn’t protect you, and neither does the compiler. The tooling layer does. GitHub and golangci-lint are the guardrails the language never added.
Worth reading
The paper itself is short - about twelve pages of content - and the attack demonstrations across C, Python, Go, JavaScript, and Rust are concrete enough that the threat model becomes immediately intuitive. Even if you’re not worried about your own codebase, it sharpens your sense of where compiler and editor interpretations can quietly diverge.