Can include_str/include_bytes access playground file system?

compiler
1

Out of curiosity I just run this on play.rust-lang.org:

fn main() {
    let s: &'static str = include_str!("../Cargo.toml");
    println!("{}", s);
}

It prints a large Cargo.toml. What if there are other files the script can access? Do include_str! and include_bytes! access a fake or real file system?

2

The playground runs binaries, which yes, can access the filesystem: Rust Playground (presumably include_*! macros can too)

But it's sandboxed in a Docker container.

6 Likes
3

Here's the source, it's really not doing anything particularly magic: it just builds a docker image that with the current cargo and rust, a few wrapper scripts, and a template Cargo.toml with the top 100 crates (that's what you saw!)

When it's run, they set some quotas on the docker container, and you're pretty much good.

It's important to realize that docker isn't intended as a security mechanism, though (though it's gotten better), so really the security here is that it's being run on AWS EC2, which basically means the most power you can get is to take over a temporary machine with no permissions or network access, which means the worst risk is being able to intercept the things other people are sending to the playground - hardly a risk.

2 Likes
4

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.