{"uuid": "7dc7e9dc-d58b-41e3-ab92-9e4f220f9a12", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-42574", "type": "seen", "source": "https://gist.github.com/raeq/631259c850e112177c498b657400259e", "content": "#!/usr/bin/env python3\n\"\"\"disarm 0.14.1 vs arXiv:2503.14281v4 (XOXO, Storek et al.) \u2014 code as LLM context.\n\nXOXO poisons the *code* an AI coding assistant pulls into an LLM prompt. This probe\nanswers three questions about disarm at that boundary.\n\n  pip install disarm==0.14.1 && python xoxo_code_context_probe.py\n\nExpected output (disarm 0.14.1, CPython 3.13):\n\n  [1] XOXO payload itself\n      every predicate False on both spellings; no transform merges them.\n  [2] Trojan Source (CVE-2021-42574), the paper's real MULTI-LINE PoC\n      strip_bidi          lines=10  still_C=True\n      strip_format        lines=0   still_C=False\n      canonicalize        lines=0   still_C=False\n      canonicalize_strict lines=0   still_C=False\n      strip_obfuscation   lines=0   still_C=False\n  [3] ASCII code points rewritten by the confusable fold\n      U+0022 \" -> ''   U+0060 ` -> '   U+007C | -> l\n  [4] a code-safe composition\n      lines preserved, bidi removed, quotes intact\n  [5] NFKC-equivalent identifier rename (PEP 3131) \u2014 semantics-preserving by the\n      language, not by search:  has_anomalies False, is_confusable True\n\"\"\"\n\nimport ast\nimport unicodedata\n\nimport disarm\nfrom disarm import TextPipeline, get_pipeline\n\nBIDI = \"\u202a\u202b\u202c\u202d\u202e\u2066\u2067\u2068\u2069\u200e\u200f\u061c\"\n\n\ndef rule(n, title):\n    print(f\"\\n[{n}] {title}\\n\" + \"-\" * 72)\n\n\n# --------------------------------------------------------------------------- 1\nrule(1, \"XOXO payload itself (\u00a73.3, the GitHub Copilot PoC rename)\")\nclean = \"USE_RAW_QUERIES = False\\nif USE_RAW_QUERIES:\\n    pass\\n\"\npoisoned = \"RAW_QUERIES = False\\nif RAW_QUERIES:\\n    pass\\n\"\nprint(\"pure ASCII:\", disarm.is_ascii(clean), disarm.is_ascii(poisoned))\nfor name in (\"has_anomalies\", \"is_confusable\", \"is_mixed_script\", \"is_zalgo\"):\n    fn = getattr(disarm, name)\n    print(f\"  {name:18} clean={fn(clean)!s:6} poisoned={fn(poisoned)}\")\nprint(\"  inspect_anomalies(poisoned):\", disarm.inspect_anomalies(poisoned))\nfor name, fn in (\n    (\"canonicalize\", disarm.canonicalize),\n    (\"strip_obfuscation\", disarm.strip_obfuscation),\n    (\"llm_guardrail\", get_pipeline(\"llm_guardrail\")),\n    (\"search_key\", disarm.search_key),\n):\n    print(f\"  {name:18} merges the two spellings: {fn(clean) == fn(poisoned)}\")\n\n# --------------------------------------------------------------------------- 2\nrule(2, \"CVE-2021-42574 Trojan Source \u2014 the published MULTI-LINE C PoC\")\nTROJAN_FILE = (\n    \"#include \\n\"\n    \"#include \\n\"\n    \"\\n\"\n    \"int main() {\\n\"\n    \"    bool isAdmin = false;\\n\"\n    \"    /*\u202e } \u2066if (isAdmin)\u2069 \u2066 begin admins only */\\n\"\n    '        printf(\"You are an admin.\\\\n\");\\n'\n    \"    /* end admins only \u202e { \u2066*/\\n\"\n    \"    return 0;\\n\"\n    \"}\\n\"\n)\nprint(\"input lines:\", TROJAN_FILE.count(\"\\n\"))\nfor name in (\"strip_bidi\", \"strip_format\", \"canonicalize\", \"canonicalize_strict\", \"strip_obfuscation\"):\n    out = getattr(disarm, name)(TROJAN_FILE)\n    compiles = out.count(\"\\n\") > 1 and '\"You are an admin' in out\n    print(\n        f\"  {name:20} lines={out.count(chr(10)):<3} \"\n        f\"bidi_gone={not any(c in out for c in BIDI)!s:6} still_C={compiles}\"\n    )\nprint(\"  canonicalize output:\")\nprint(\"   \", repr(disarm.canonicalize(TROJAN_FILE))[:200], \"...\")\n\n# --------------------------------------------------------------------------- 3\nrule(3, \"ASCII code points the confusable fold rewrites (refs #725)\")\nhits = [\n    (cp, chr(cp), disarm.normalize_confusables(\"x\" + chr(cp) + \"y\"))\n    for cp in range(0x20, 0x7F)\n    if disarm.normalize_confusables(\"x\" + chr(cp) + \"y\") != \"x\" + chr(cp) + \"y\"\n]\nfor cp, ch, out in hits:\n    print(f\"  U+{cp:04X} {ch!r:5} -> x{out[1:-1]!r}y\")\nprint(\"  total:\", len(hits))\n\n# --------------------------------------------------------------------------- 4\nrule(4, \"A code-safe composition (TextPipeline, collapse_whitespace=False)\")\ncode_safe = TextPipeline(\n    strip_bidi=True, strip_zero_width=True, strip_control=True, collapse_whitespace=False\n)\nout = code_safe(TROJAN_FILE)\nprint(\"  lines:\", out.count(\"\\n\"), \"| bidi gone:\", not any(c in out for c in BIDI))\nprint('  quotes intact:', '\"You are an admin' in out, \"| indentation intact:\", \"    return 0;\" in out)\nprint(out)\n\n# --------------------------------------------------------------------------- 5\nrule(5, \"NFKC-equivalent identifier rename \u2014 PEP 3131 makes it semantics-preserving\")\nto_math = {chr(ord(\"A\") + i): chr(0x1D5A0 + i) for i in range(26)}\nspoof = \"\".join(to_math.get(c, c) for c in \"RAW_QUERIES\")\nprint(\"  spoof:\", spoof, \"| NFKC == 'RAW_QUERIES':\",\n      unicodedata.normalize(\"NFKC\", spoof) == \"RAW_QUERIES\")\nsrc = \"RAW_QUERIES = False\\n\\ndef f(q):\\n    if \" + spoof + \":\\n        return 'raw'\\n    return 'safe'\\n\"\nns: dict = {}\nexec(compile(src, \"\", \"exec\"), ns)\nprint(\"  runtime names:\", sorted(n for n in ns if not n.startswith(\"__\")))\nprint(\"  behaves identically:\", ns[\"f\"](\"x\") == \"safe\")\nfor name in (\"has_anomalies\", \"is_confusable\", \"is_mixed_script\"):\n    print(f\"  {name:18} {getattr(disarm, name)(src)}\")\nprint(\"  inspect_anomalies:\", disarm.inspect_anomalies(src))\n", "creation_timestamp": "2026-08-30T10:16:15.990296Z"}