3 ms·
I am not a Rust expert, but wouldn't extension traits and Unicode character look-alikes allow for a subtle attack vector? What would stop someone from creating
by thesuperbigfrog 5y ago
I am not a Rust expert, but wouldn't extension traits and Unicode character look-alikes allow for a subtle attack vector?
What would stop someone from creating a trait that looks similar to an existing function name, but that does something bad?
- richardwhiuk 5y agoRust emits a compiler warning if you use homoglyphs: https://blog.rust-lang.org/2021/06/17/Rust-1.53.0.html#unicode-identifiers https://blog.rust-lang.org/2021/06/17/Rust-1.53.0.html#unico...
- chewbacha 5y agoYou would still need to import the malicious trait in order for it to be extended. If you already have included a bad crate which has a bad trait, then why not replace the implementation of a well-named function. I can’t see a reason to use a homoglyph in the function name.
- melissalobos 5y agoSimilar-ish concerns have been raised before: https://www.lightbluetouchpaper.org/2021/11/01/trojan-source-invisible-vulnerabilities/ https://www.lightbluetouchpaper.org/2021/11/01/trojan-source...
- capitalsigma 5y agoRemember that in Python you can mutate `globals` to change the meaning of arbitrary symbols. It seems like a lost cause if you are running a compromised library.