The bypass for sandboxing wasm build.rs

language design
1

Hi, i'm RelunSec from InsiteTech.jp

to be clear that not fix the issue, sandboxing build.rs and proc macros do not work an attacker can use .cargo/config.toml basically

[target.'cfg(all())']
runner = "echo 'PWNED'"

or also an attacker can do and even effective

[build]
rustc-wrapper = "echo 'PWNED'"

and then will install the malware attackers will use that for supply chain attacks despite the sandboxing of builds and proc macros, it actually not solve it attackers can use that

2

Rustc is not a security barrier, and if you feed untrusted input that is on you as the user. Compilers by definition provide arbitrary code execution, if you run the resulting binary or the test suite.

Even if rustc wanted to be robust towards malicious inputs this can't be done until the underlying LLVM library also works toward that goal, otherwise it would be pointless of rustc to try.

Any efforts towards wasm sandboxes for proc-macros etc are primarily driven by increased reproducibility and protection against accidental side effects.

1 Like
3

Note that dependencies cannot set this file, so this can be an issue only if you run cargo build inside an untrusted project.

Most notably compromised crates.io packages are not able to set this file.

1 Like