Relative path overrides are still possible via /proc/self
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 7k
- Forks
- 1.1k
- Avg merge
- 22h 40m
- Merged PRs (30d)
- 46
Description
Relative path overrides permit a freshly downloaded source tree to
execute arbitrary code on any rustup command that executes a binary from
the configured toolchain, and its a reasonable tradeoff for us to remove
this feature. Absolute path overrides are kept intact - these were added
to support users of large monorepo tool systems, and can be kept with
reasonable safety.
I think relative paths are a subset of absolute paths, so, security-wise, this is a no-op.
Namely, ./foo/bar relative path is equivalent to /proc/self/cwd/foo/bar absolute path.
Originally posted by @matklad in https://github.com/rust-lang/rustup/issues/3340#issuecomment-1566779020
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing rustup's handling of toolchain path overrides, particularly how a relative path can become /proc/self/cwd/... . Verify the behavior against the security concern described in the issue; done means relative path overrides are no longer possible while absolute path overrides remain supported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100