Removing false positive warnings related to CVE-2021-42694 from the binutils code base

[Matthieu Longo]

Hi,

Due to CVE-2021-42694 (see [1] and [2] for more details), some tools 
warn whenever non-ASCII characters appear in a source file.
Those warnings aim at highlighting a potential avenue of surreptitious 
source code alteration, relying on the usage of confusable Unicode 
characters.

In my opinion, instances that are generating false positives (e.g. in 
[3]) should be removed, unless the presence of such characters is 
necessary for the job at hand. Indeed, keeping unneeded exceptions 
causes a risk of missing a genuine warning due to the noise caused by 
the false positives.

At the same time, removing all Unicode characters from comments can be 
limiting. See e.g. the use of non-ASCII Σ in [4] which is used simply to 
stay in sync with the respective documentation.

Given the conflicting points of view on the topic, I am looking for 
guidance from the binutils maintainers.

Regards,
Matthieu


[1]: LWN article: https://lwn.net/Articles/874951/
[2]: Associated paper: https://trojansource.codes/trojan-source.pdf
[3]: 
https://inbox.sourceware.org/binutils/de7b5208-8d29-494b-8d4c-78e1302e37f4@arm.com/T/#m511a13422a67a6b6c4fdfa5ed62597191c0c281c
[4]: 
https://xenbits.xen.org/gitweb/?p=xen.git;a=blob;f=tools/tests/x86_emulator/simd-sha.c;hb=refs/heads/staging