LuisCastellanos-dev

GitHub · Repository owner · Source ID 282130403
Source profile

Source-scoped identity with 1 associated PoC and 1 linked vulnerability.

Showing 1 PoC on this page

GitHub

LuisCastellanos-dev/cobol-shield

Repository PoC0Created 2026-08-12ScannerCVE-2021-425745 files

13.4 KiB

GitHubPoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a security toolkit that detects and cleans invisible Unicode characters in source code and data files. It provides a CI checker (check-invisibles.py) that scans files for dangerous Unicode ranges and exits with a non-zero code on detection, and a sanitizer (clean-invisibles.py) that removes such characters and generates an audit log. The tools are designed to mitigate CVE-2021-42574 (Trojan Source) and related Unicode attacks. No exploit code is present; the tools only identify and report the presence of dangerous characters.

Backdoor review

No backdoor observed in reviewed code

The repository contains a security toolkit for detecting and cleaning invisible Unicode characters in COBOL source code, addressing CVE-2021-42574. The provided Python scripts perform local file scanning and sanitization as documented. No concealed, deceptive, or harmful behavior targeting the operator or unrelated systems was found.

ClassificationScanner
Model confidence98%
AuthenticationNot required
LanguagesPythonCOBOL
Target softwareGnuCOBOLZowe APICOBOL legacy systems
Attack typesUnicode Bidirectional Algorithm manipulationTrojan Source
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a scanner. The check-invisibles.py script is explicitly described as a 'CI checker' that 'exits 1 on detection' (README.md line 32). It scans files for dangerous Unicode characters and reports their locations without modifying the target or exercising a vulnerability. The clean-invisibles.py script is a sanitizer that removes dangerous characters, which is a defensive tool, not an exploit. No code in the artifact attempts to exploit CVE-2021-42574 or any other vulnerability; it only detects and cleans the presence of dangerous Unicode sequences.

README.md:32tools/check-invisibles.py:1-14tools/check-invisibles.py:37-43

Requirements

  • Python 3 interpretertools/check-invisibles.py:1
  • Read access to target filestools/check-invisibles.py:66-74

Observed behavior

  • Scans files with specific extensions for Unicode characters in predefined dangerous rangestools/check-invisibles.py:20-28tools/check-invisibles.py:34
  • Reports the file, line, column, and hex bytes of any dangerous character foundtools/check-invisibles.py:54-62
  • Exits with code 1 if any dangerous characters are detected, 0 otherwisetools/check-invisibles.py:85-94
  • Sanitizer removes dangerous characters and creates a backup of the original filetools/clean-invisibles.py:82-86
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Scanning Behavior
Payload withheldThis is the disclosed functionality of the PoC, acting as a CI checker.tools/check-invisibles.py:46-63tools/check-invisibles.py:85-91
File Sanitization Behavior
Payload withheldThis is the disclosed functionality of the PoC, acting as a sanitizer with forensic logging.tools/clean-invisibles.py:34-89
Network Activity
Payload withheldThe scripts operate solely on the local filesystem, reading and writing files as specified by the user-provided path argument.tools/check-invisibles.py:1-98tools/clean-invisibles.py:1-135
Review boundaries

What the analysis did not establish

  • Two files (src/AUDITOR-INVISIBLE.cob and .github/workflows/unicode-check.yml) are referenced in the README but not included in the evidence packet; their content is unknown.
  • The evidence packet reports complete_artifact_coverage as false, indicating that not all files from the repository snapshot are included.
  • The analysis is based solely on the provided text content; no code was executed, and the behavior described is inferred from static analysis.
  • Two files (src/AUDITOR-INVISIBLE.cob and .github/workflows/unicode-check.yml) were not provided as text and were not reviewed.
  • The review is limited to the supplied text evidence and does not include execution or analysis of the compiled COBOL program.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.