this post was submitted on 09 Apr 2024
49 points (98.0% liked)

Rust

6005 readers
2 users here now

Welcome to the Rust community! This is a place to discuss about the Rust programming language.

Wormhole

!performance@programming.dev

Credits

  • The icon is a modified version of the official rust logo (changing the colors to a gradient and black background)

founded 1 year ago
MODERATORS
snowe@programming.dev
Ategon@programming.dev
EdTheLegendary@programming.dev
kahnclusions@programming.dev
torcherist@programming.dev
49
Security advisory for the standard library (CVE-2024-24576) (blog.rust-lang.org)
submitted 7 months ago by snaggen@programming.dev to c/rust@programming.dev
10 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[โ€“] Schmeckinger@feddit.de 1 points 7 months ago (1 children)

But there is no reason to use a script, when you have a build.rs anyways. Since pretty much everything the script can do build.rs can do better.

[โ€“] sugar_in_your_tea@sh.itjust.works 3 points 7 months ago* (last edited 7 months ago)

That's not going to be particularly feasible when generating bindings and other complex build processes. For example, the Qt bindings run shell commands as part of the build.rs. As does gettext-rs.

So I don't think it's unreasonable to think a developer could sneak in an exploit with "temporary code" to improve some part of the build process on Windows.