alt Hacker NewsThe problem isn't the language here, it's cargo executing build.rs from dependencies which necessarily allows arbitrary code execution.
Replies
dwattttt • today at 8:54 PM
Running what you've built when you've added a malicious dependency also causes arbitrary code execution.
(as I and others have mentioned in the thread): The attacker can just move the malicious code from build.rs to lib.rs (ie. build-time -> test/execution-time).
Then the problem is the language, as the grandparent observes.