This application detects Trojan Source attacks in source code. It can be used as part of the CI system to make sure there are no trojan source / unicode bi-directional text attacks in a pull request.

This utility can be used either on GitHub Actions:

jobs:
  trojansource:
    name: Trojan Source Detection
    runs-on: ubuntu-latest
    steps:
      # Checkout your project with git
      - name: Checkout
        uses: actions/checkout@v2
      # Run trojansourcedetector
      - name: Trojan Source Detector
        uses: haveyoudebuggedit/trojansourcedetector@v1

You can also run it on any CI system by simply downloading the released binary and running:

./trojansourcedetector

You can customize the behavior by providing a config file. This file is named .trojansourcedetector.json by default and has the following fields:

For an example you can take a look at the .trojansourcedetector.json in this repository.

If you want to use a different file name, you can change your GitHub Actions config:

jobs:
  trojansource:
    name: Trojan Source Detection
    runs-on: ubuntu-latest
    steps:
      # Checkout your project with git
      - name: Checkout
        uses: actions/checkout@v2
      # Run trojansourcedetector
      - name: Trojan Source Detector
        uses: haveyoudebuggedit/trojansourcedetector@v1
        with:
          config: path/to/config/file

Or, if you are using the command line version, you can simply pass the -config option with the appropriate config file.

This tool can be built using Go 1.17 or higher:

go build cmd/trojansourcedetector/main.go

In order to run tests, you will need to run the following two commands:

go generate
go test -v ./...