otp: add bidi scanner

addition of bidi scanner and fix of invisible unicode from when
Erlang/OTP translated XML to markdown.

Author: kikofernandez

.github/workflows/main.yaml

@@ -89,6 +89,34 @@ jobs:
              exit 1
           fi
 
+  semgrep:
+    name: Semgrep Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    container:
+      image: semgrep/semgrep@sha256:a3d49dc967b8534a6a76628e50c51cbfe33eb7195dc2feab1fdc0f100852c8ef
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Run Semgrep
+        env:
+          SEMGREP_SEND_METRICS: off
+        run: |
+          semgrep \
+            --config ".semgrep/" \
+            --error \
+            --sarif \
+            --output semgrep.sarif
+
+      - name: Upload SARIF to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@2d6b98c7cf7260afd6954ee7de478b21127b40f4 # ratchet:github/codeql-action/upload-sarif@v3.29.7
+        with:
+          sarif_file: semgrep.sarif
+        if: always()
+
   pack:
     name: Build Erlang/OTP (64-bit)
     runs-on: ubuntu-latest

.semgrep/bidi-unicode.yaml

@@ -0,0 +1,37 @@
+#
+# %CopyrightBegin%
+#
+# SPDX-License-Identifier: Apache-2.0
+#
+# Copyright Ericsson AB 2026. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+# %CopyrightEnd%
+#
+rules:
+  - id: bidi-invisible-unicode
+    patterns:
+      - pattern-regex: "[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF\u00AD]"
+    message: >
+      Dangerous bidirectional or invisible Unicode character detected in $PATH.
+      This may indicate a Trojan Source attack (CVE-2021-42574).
+      Remove or replace the character.
+    languages:
+      - generic
+    severity: ERROR
+    metadata:
+      category: security
+      cwe: "CWE-116"
+      references:
+        - https://trojansource.codes

.semgrepignore

@@ -0,0 +1,30 @@
+%
+% %CopyrightBegin%
+%
+% SPDX-License-Identifier: Apache-2.0
+%
+% Copyright Ericsson AB 2026. All Rights Reserved.
+%
+% Licensed under the Apache License, Version 2.0 (the "License");
+% you may not use this file except in compliance with the License.
+% You may obtain a copy of the License at
+%
+%     http://www.apache.org/licenses/LICENSE-2.0
+%
+% Unless required by applicable law or agreed to in writing, software
+% distributed under the License is distributed on an "AS IS" BASIS,
+% WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+% See the License for the specific language governing permissions and
+% limitations under the License.
+%
+% %CopyrightEnd%
+%
+.semgrep/
+lib/stdlib/uc_spec/
+lib/stdlib/test/io_proto_SUITE_data/external_utf8_bom.dat
+lib/stdlib/test/io_proto_SUITE_data/testdata_utf8_bom.dat
+lib/kernel/test/interactive_shell_SUITE.erl
+lib/stdlib/test/json_SUITE_data/i_structure_UTF-8_BOM_empty_object.json
+lib/stdlib/test/json_SUITE_data/n_structure_UTF8_BOM_no_data.json
+lib/stdlib/test/re_SUITE_data/testoutput4
+semgrep.sarif

erts/doc/references/erlc_cmd.md

@@ -257,7 +257,7 @@ of situations that force a restart:
   [compile server](erlc_cmd.md#compile_server) by the given name, allowing a
   single user to run multiple unrelated builds in parallel without them
   affecting each other, which can be useful for shared build machines and the
-  like. The name must be alpha­numeric, and it defaults to being empty.
+  like. The name must be alpha-numeric, and it defaults to being empty.
 
 ## See Also