Using Rust Macros to exfiltrate secrets

This can be done even easier without users having to use a macro: with `build.rs` build scripts, which are run by default. So all you'd need is to compromise some popular dependency with a custom build.rs

Many other languages have the same (or at least similar) problem (Makefiles, npm hooks, ...)

There is an interesting proposal and prototype for compiling proc macros to WASM so they can be run in a sandbox: https://github.com/dtolnay/watt

But in the end it doesn't make that much difference: nothing prevents a random library from just reading your secrets and calling curl to send it to a server at runtime.

Build time execution is definitely an additional attack vector.

But if you use a third party dependency, you have to trust it or review all it's code for every version. There is no way around this, and it's true for any language.

It's a class of supply chain attack focusing on build time code evaluation. Almost every programming language has some kind of support for arbitrary code execution at build time, and any project of scale is going to require it.

RCE isn't an interesting exploit when the system is literally designed to run code from somewhere else.

A python plugin for an editor would have the same problem - if it imports a python module for any reason, like code completion. Same problem of arbitrary code execution.

I think we should work on solutions. Sandboxing both for editor plugins and for regular rust builds, should become the norm.