• thingsiplay@beehaw.org
      link
      fedilink
      arrow-up
      24
      ·
      7 months ago

      But it got a 10/10 on the scoring system by Github.

      The issue isn’t actually too much related to the Rust core language itself, but rather how they handle scripts on Windows platform. So if you don’t have a Windows program that runs Batch scripts, then it doesn’t matter to you. I wonder how common it is to run Batch scripts in Rust?

      • TehPers@beehaw.org
        link
        fedilink
        English
        arrow-up
        8
        ·
        7 months ago

        if you don’t have a Windows program that runs Batch scripts with untrusted arguments

        This only matters when running the scripts with user inputs passed as arguments to the command, which I can’t imagine being remotely common at all.

      • tatterdemalion@programming.dev
        link
        fedilink
        arrow-up
        6
        arrow-down
        1
        ·
        7 months ago

        I don’t think my company uses batch scripts anywhere, but if they did, it would probably be in the app installer for Windows or something.

    • Sekoia@lemmy.blahaj.zone
      link
      fedilink
      arrow-up
      17
      arrow-down
      3
      ·
      7 months ago

      Also, the reason this is a CVE is because Rust itself guarantees that calling commands doesn’t evaluate shell stuff (but this breaks that guarantee). As far as I know C/C++ makes no such guarantee whatsoever.

      • xmunk@sh.itjust.works
        link
        fedilink
        arrow-up
        6
        ·
        7 months ago

        C++ has no guarantees built into stdlib but frameworks like Qt provide safe access - the ecosystem has options. C++ itself is quite a simple language, most of the power comes out of toolsets and frameworks built on top of it.

            • arendjr@programming.dev
              link
              fedilink
              arrow-up
              5
              arrow-down
              2
              ·
              edit-2
              7 months ago

              That’s certainly not the case, because that’s like saying the issue is with Rust’s string slices. I think you may have missed the part of the issue where batch scripts require additional escaping due to Windows’ command handling. It’s a ridiculous design of the Windows API system, which is also why (almost?) every language they tested was vulnerable, so it would be actually very outstanding if Qt prevented this.

              For C++ devs not using Qt it’s just another footgun they’ll likely keep introducing security issues with as well. But if you do use Qt, I think it’s better to double-check since it may also require a patch.