otp: add bidi scanner

addition of bidi scanner and fix of invisible unicode from when
Erlang/OTP translated XML to markdown.

Author: kikofernandez

.github/workflows/main.yaml

@@ -89,6 +89,34 @@ jobs:
              exit 1
           fi
 
+  semgrep:
+    name: Semgrep Scan
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+
+    container:
+      image: semgrep/semgrep@sha256:a3d49dc967b8534a6a76628e50c51cbfe33eb7195dc2feab1fdc0f100852c8ef
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - name: Run Semgrep
+        env:
+          SEMGREP_SEND_METRICS: off
+        run: |
+          semgrep \
+            --config ".semgrep/" \
+            --error \
+            --sarif \
+            --output semgrep.sarif
+
+      - name: Upload SARIF to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: semgrep.sarif
+        if: always()
+
   pack:
     name: Build Erlang/OTP (64-bit)
     runs-on: ubuntu-latest

.semgrep/bidi-unicode.yaml

@@ -0,0 +1,16 @@
+rules:
+  - id: bidi-invisible-unicode
+    patterns:
+      - pattern-regex: "[\u200B-\u200F\u202A-\u202E\u2066-\u2069\uFEFF\u00AD]"
+    message: >
+      Dangerous bidirectional or invisible Unicode character detected in $PATH.
+      This may indicate a Trojan Source attack (CVE-2021-42574).
+      Remove or replace the character.
+    languages:
+      - generic
+    severity: ERROR
+    metadata:
+      category: security
+      cwe: "CWE-116"
+      references:
+        - https://trojansource.codes

.semgrepignore

@@ -0,0 +1,9 @@
+.semgrep/
+lib/stdlib/uc_spec/
+lib/stdlib/test/io_proto_SUITE_data/external_utf8_bom.dat
+lib/stdlib/test/io_proto_SUITE_data/testdata_utf8_bom.dat
+lib/kernel/test/interactive_shell_SUITE.erl
+lib/stdlib/test/json_SUITE_data/i_structure_UTF-8_BOM_empty_object.json
+lib/stdlib/test/json_SUITE_data/n_structure_UTF8_BOM_no_data.json
+lib/stdlib/test/re_SUITE_data/testoutput4
+semgrep.sarif

erts/doc/references/erlc_cmd.md

@@ -257,7 +257,7 @@ of situations that force a restart:
   [compile server](erlc_cmd.md#compile_server) by the given name, allowing a
   single user to run multiple unrelated builds in parallel without them
   affecting each other, which can be useful for shared build machines and the
-  like. The name must be alpha­numeric, and it defaults to being empty.
+  like. The name must be alpha-numeric, and it defaults to being empty.
 
 ## See Also