2 ms·
Package managers are for running other people's code, I would not expect the same of static analysis tools, especially since they are of use while auditing othe
by pabs3 2y ago
Package managers are for running other people's code, I would not expect the same of static analysis tools, especially since they are of use while auditing other people's code before building/running it.
- swiftcoder 2y agoCargo's threat model here is identical to that of rust analyser. If you trust your dependency tree sufficiently to run `cargo build`, then you trust it sufficiently to run rust analyser.
- pabs3 2y agoConsidering Cargo has build scripts, which are designed to run arbitrary code, that doesn't appear to be correct. https://doc.rust-lang.org/cargo/reference/build-scripts.html https://doc.rust-lang.org/cargo/reference/build-scripts.html
- swiftcoder 2y agoRust analyser executes those exact same build scripts. This is the primary avenue for exploits in both pieces of software, and is called out explicitly in the page you originally linked.
- pabs3 2y agoYes, and that is my complaint.