Comment by exDM69
3 months ago
The same applies to any Makefile, the Python script invoked by CMake or pretty much any other scriptable build system. They are all untrusted scripts you download from the internet and run on your computer. Rust build.rs is not really special in that regard.
Maybe go build doesn't allow this but most other language ecosystems share the same weakness.
Right, people forget that the xz-utils backdoor happened to a very traditional no-dependencies C project.
xz-utils has a ton of build dependencies. The backdoor implant exploited a flaw in an m4 macro build dep.
Yes but it's the fact that cargo can pull a massive unreviewed dependency tree and then immediately execute code from those dependencies that's the problem. If you have a repo with a Makefile you have the opportunity to review it first at least.
Do you review the 10k+ lines of generated bash in ./configure, too?
./configure shouldn't be in your repo unless it's handwritten
1 reply →
You are allowed to read Cargo.toml.
Cargo.toml does not contain the source code of dependencies nor transient dependencies.
3 replies →
In JavaScript just the npm install can fuck things up. Pre-install scripts can run malicious code.