3 ms·
If you're using VS Code then you can add `"rust-analyzer.check.command": "clippy"` to your `settings.json`. I assume there's a similar setting for rust-analyzer
by sestep 2y ago
If you're using VS Code then you can add `"rust-analyzer.check.command": "clippy"` to your `settings.json`. I assume there's a similar setting for rust-analyzer in other editors.
- maleldil 2y agoNeovim: require("lspconfig").rust_analyzer.setup({ settings = { ["rust-analyzer"] = { checkOnSave = { command = "clippy", allFeatures = true, }, }, }, })
- pabs3 2y agoYou might want to reconsider use of rust-analyzer, it isn't safe to use on code you haven't written yourself. https://rust-analyzer.github.io/book/security.html https://rust-analyzer.github.io/book/security.html
- swiftcoder 2y ago> it isn't safe to use on code you haven't written yourself Neither is cargo (nor npm, nor any other package manager, for that matter). I'm not sure what value being that paranoid is buying you in the long run.
- pabs3 2y agoPackage managers are for running other people's code, I would not expect the same of static analysis tools, especially since they are of use while auditing other people's code before building/running it.
- swiftcoder 2y agoCargo's threat model here is identical to that of rust analyser. If you trust your dependency tree sufficiently to run `cargo build`, then you trust it sufficiently to run rust analyser.
- pabs3 2y agoConsidering Cargo has build scripts, which are designed to run arbitrary code, that doesn't appear to be correct. https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html
- swiftcoder 2y agoRust analyser executes those exact same build scripts. This is the primary avenue for exploits in both pieces of software, and is called out explicitly in the page you originally linked.
- pabs3 2y agoYes, and that is my complaint.