12 ms·
The problem is that build scripts run automatically without user consent or intevention. `cargo add` is sufficient to compromise you, before you have a chance
by Aeolos 28d ago
The problem is that build scripts run automatically without user consent or intevention.
`cargo add` is sufficient to compromise you, before you have a chance to even vet the code.
- kibwen 28d ago`cargo add` just modifies your Cargo.toml, it doesn't build anything.
- xdavidliu 27d agohttps://shnatsel.medium.com/do-not-run-any-cargo-commands-on-untrusted-projects-4c31c89a78d6 https://shnatsel.medium.com/do-not-run-any-cargo-commands-on... > any command starting with cargo can run arbitrary code when operating on an untrusted repository, and should be treated the same as cargo run.
- kibwen 25d agoThis comment is both true and entirely irrelevant. The context of this subthread is not running a Cargo command in a checkout of a malicious git repo, it's alleging that `cargo add foo` runs the build script of the crate `foo`, which is false.