31–40 of 76 posts
Earlier quoted context omitted.
Also, it’s not a new problem; a Makefile or configure script can run arbitrary code as well.
Citation needed. Show me a Makefile + IDE combination that executed code by simply opening a file. I think you’re missing the language server part of this.
Blocks of text again... TL;DR?
Proc macros can run arbitrary code, so this POC is not that interesting - apart from raising awareness for the problem. This can be done even easier without users having to use a macro: with `build.rs` build scripts, which are run by default. So all you'd need is to compromise some popular dependency with a custom build.rs Many other languages have the same (or at least similar) problem (Makefiles, npm hooks, ...) Th…
> Many other languages have the same problem (Makefiles, npm hooks, ...) This simply isn’t true. All of these require an action by a user to execute the command (e.g npm install, make build). What the author is claiming is that a typical rust LSP setup will execute the arbitrary macro code simply by viewing the file in certain IDEs. Feel free to show me an example of this in makefiles or npm and I’m happy to retract.
Languages with similar risks are ones where a Repl is is the key form of development. In those scenarios you are also one bad dependency from stolen info.
Earlier quoted context omitted.
This is as huge a deal as "using ./configure && make install to exfiltrate secrets." It's a class of supply chain attack focusing on build time code evaluation. Almost every programming language has some kind of support for arbitrary code execution at build time, and any project of scale is going to require it. RCE isn't an interesting exploit when the system is literally designed to run code from somewhere else.
This isn’t build time though really, which I agree is a moment you would expect to run arbitrary code. This is “edit time.”
Blocks of text again... TL;DR?
Earlier quoted context omitted.
Also, it’s not a new problem; a Makefile or configure script can run arbitrary code as well.
Apart from running make which of course runs the makefile, under what scenario does viewing a makefile run it?
VALUE := $(shell touch /tmp/something)I can't believe that people is comparing opening a project in a code editor with running a build script. The PoC doesn't even open a file, it just opens the directory. It's a pretty big difference, when you execute a build script you _expect_ to run code, when you open a directory in your editor you don't expect any side effect _at all_. My guess is that since the proc_macros returns a TokenStream, rust-analyzer have…
Safest way would probably be something hilarious like having the analyzer compiled to WASM and ran in node.js.
Earlier quoted context omitted.
Also, it’s not a new problem; a Makefile or configure script can run arbitrary code as well.
Citation needed. Show me a Makefile + IDE combination that executed code by simply opening a file. I think you’re missing the language server part of this.
This is a huge deal right? VSCode has to be one of the most popular editors and the standard way of setting up the Rust toolchain on a machine would get you in a state that makes you vulnerable to this.
For what it's worth, any VSCode extension that integrates with language tooling could be used to implement this.