3 ms·
> could be addressed by running proc macros in a wasm sandbox Kind of. That will stop the compromise on build, but odds are then you run the code anyways so in
by kevincox 5y ago
> could be addressed by running proc macros in a wasm sandbox
Kind of. That will stop the compromise on build, but odds are then you run the code anyways so injecting the code into the executable is almost as good. I guess if you are building an application that is always run in a sandbox anyways (like a wasm application that never sees sensitive data) then sandboxing proc macros could be good enough but I suspect that is a very rare case.
- curun1r 5y agoMy comment specifically called it out as a half measure. But that doesn’t mean it’s not worth doing. One of the ways that I’d see a proc macro attack playing out in real life would be to attempt to obtain the API token from cargo login to allow the attacker to publish a malicious version of a popular crate. But if cargo login is only run on the CI instance responsible for publishing and developers test their code on their individual dev machines, the attack fails. We shouldn’t worry about making security 100% effective. Rather, we should be concerned with stopping as many different attacks as we can and providing users with as many building blocks as possible to let them protect themselves. There will always be vulnerabilities. But using that as an excuse for inaction isn’t helpful.