3 ms·
Just as a funny data point, when it turned out that Go's go get command allowed you to run “arbitrary” code during build (not directly, but through gcc and clan
by ainar-g 5y ago
Just as a funny data point, when it turned out that Go's go get
command allowed you to run “arbitrary” code during build (not
directly, but through gcc and clang's -plugin and -ftplugin
features), it was marked as a CVE[1], heh.
[1]: https://www.cvedetails.com/cve/CVE-2018-6574/ https://www.cvedetails.com/cve/CVE-2018-6574/
- gspr 5y agoRust's Cargo seems to suffer from the same. And the tooling to avoid the wild "grab things from the Internet" route is quite lacking (shameless plug for attention: https://github.com/rust-lang/cargo/issues/10045 https://github.com/rust-lang/cargo/issues/10045). I don't have a problem with making the convenient route possible, but it's very troubling that the tooling actively fights you if you want to take a saner approach.