Replacing smartstring which is unmaintained, has UB and a restrictive license
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 5.7k
- Forks
- 249
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 23
Description
In part of my miri testing of Rhai, I've discovered that the smartstring crate is unsound in general. After spending many hours tracking down the cause of the UB, I finally narrowed it down and found an issue report for the exact UB. The example I posted also introduces the same UB in Rhai when using the ImmutableString type. (Though it's not limited to my example)
I don't know what the exact unsound conditions for the UB are, but I'm sure someone has accidentally triggered it in Rhai (as I have as well).
The same UB mentioned in the issue below can also be triggered with a var.into() for ImmutableString in Rhai.
Since the last update for this crate was ~2 years ago, I have some doubts on whether the UB will ever be fixed.
https://github.com/bodil/smartstring/issues/49
Note, there IS a PR with the fix as far as I can tell, but the author seems to have been unresponsive to issues/PRs. This could be quickly patched by cloning the repo and using that one instead however
For any people who see this and want to fix the potential UB, see this PR for the fix, clone the repo and commit the fix, then place the following lines in your Cargo.toml:
[patch.crates-io]
smartstring = { git = "URL to your patched git repo" }
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing Rhai's ImmutableString usage and the dependency configuration in Cargo.toml, then read smartstring issue #49 and pull request #34. Compare the proposed patched dependency approach with replacing smartstring; done means the UB concern is addressed without depending on the unmaintained release.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100