On: Malicious Rust crate Arrayref runs a build-time payload

[cpuguy83]

The problem isn't the language here, it's cargo executing build.rs from dependencies which necessarily allows arbitrary code execution.

[jaen → cpuguy83]

(as I and others have mentioned in the thread): The attacker can just move the malicious code from build.rs to lib.rs (ie. build-time -> test/execution-time).

Then the problem is the language, as the grandparent observes.

[cpuguy83 → jaen]

Sure, but I don't expect build to execute arbitrary code. That's a big difference.

It's like if `git clone` ran random stuff from the cloned repo.

[dwattttt → cpuguy83]

Running what you've built when you've added a malicious dependency also causes arbitrary code execution.