3 ms·

https://shnatsel.medium.com/do-not-run-any-cargo-commands-on-untrusted-projects-4c31c89a78d6 https://shnatsel.medium.com/do-not-run-any-cargo-commands-on... >

https://shnatsel.medium.com/do-not-run-any-cargo-commands-on-untrusted-projects-4c31c89a78d6 https://shnatsel.medium.com/do-not-run-any-cargo-commands-on... > any command starting with cargo can run arbitrary code when operating on an untrusted repository, and should be treated the same as cargo run.

kibwen 1mo ago
This comment is both true and entirely irrelevant. The context of this subthread is not running a Cargo command in a checkout of a malicious git repo, it's alleging that `cargo add foo` runs the build script of the crate `foo`, which is false.