Is Swift vulnerable to Trojan Source attacks?

Using Swift
5

string spoofing is easy done by more traditional methods. below contains two different methods: a zero width spacer between "u" and "s" in the second string (which you can notice if you put the cursor at the beginning of "user" and advance it one by one with the arrow key). also cyrillic "е" is used instead of latin "e" in the second string (homoglyph).

func test() {
    let accessLevel = "user"
    if accessLevel != "u​sеr" {
        print("You're an admin")
    }
}

test()

the following can also be used for attacks in swift, doesn't use any special characters:

func bar() {
    print("hello, world")
}

func foo() {
    return
    // ignore the rest
    bar()
}

foo()

good thing it gives a warning: Warning: Expression following 'return' is treated as an argument of the 'return'

1 Like