5 ms·
The problem isn't the language here, it's cargo executing build.rs from dependencies which necessarily allows arbitrary code execution.
by cpuguy83 27d ago
The problem isn't the language here, it's cargo executing build.rs from dependencies which necessarily allows arbitrary code execution.
- jaen 27d ago(as I and others have mentioned in the thread): The attacker can just move the malicious code from build.rs to lib.rs (ie. build-time -> test/execution-time). Then the problem is the language, as the grandparent observes.
- cpuguy83 27d agoSure, but I don't expect build to execute arbitrary code. That's a big difference. It's like if `git clone` ran random stuff from the cloned repo.
- dwattttt 27d agoRunning what you've built when you've added a malicious dependency also causes arbitrary code execution.