Security advisory for crates.io

As always: there are no silver bullets. Static typing, nor Rust, can save you from all bugs.

If you follow the link to the security announcement list, you can see the one other advisory we've had since 1.0 as well.

the second 'precaution' fix looks actually important because it stops an archive from a following a symlink it creates that would allow it to write outside of the package directory. my thoughts are:

before the precaution fix this was a legal archive:

    $crate_name-$crate_version/outside -> ../
    $crate_name-$crate_version/outside/$other_crate-$other-version/blah/blah

then you have this code:

https://github.com/rust-lang/cargo/pull/4493/files#diff-ce3a...

  tar.unpack(dst.parent().unwrap())?;

so while Archive#unpack protects you against following symlinks outside of `dst` (which is a really good default!) it doesn't protect you from following symlinks inside of `dst` so presumably you can use the symlink trick to overwrite other packages.

i haven't tested this so this could be wrong :/ like maybe archive by default doesn't create symlinks or reorders the extraction so symlinks are always created last.

the response time of the rust team was extremely quick, great job!

2017-09-13 @ 19:19 - Justin sends mail to security@rust-lang.org about this

2017-09-13 @ 19:28 - response sent to Justin acknowledging the vulnerability

2017-09-13 @ 21:14 - a patch to crates.io was finished, all current tarballs verified not-malicious

It might depend on how the Javascript is being blocked. I use uBlock Origin advanced mode to selectively block Javascript (I imagine uMatrix is similar), and always have to whitelist discourse's CDN.

The difference is probably that selective blockers like uBlock/uMatrix don't show elements, while globaly disabling Javascript does, and discourse might be relying on the noscript element (on mobile right now, so I can't check to be sure).

Rust gives us memory safety. But I wonder if somebody is working on a language which syntactically enforces safe filesystem access, and relegates anything resembling the POSIX API to unsafe{}?..