alt Hacker Newscargo add + rust-analyzer instantly executes build.rs before you have a chance to audit the code.
Cargo, please PLEASE give me a way to disable third-party build.rs and whitelist the ones I need. And please loudly mark any update that adds a build.rs where there was none before.
Replies
bigstrat2003 • today at 5:05 PM
So, don't add dependencies before you audit the code? That seems like a pretty reasonable ask to me.
cargo-deny can audit build scripts, but unfortunately not prevent execution of malicious build scripts exactly for the reason you gave. It could still help if you only ever use cargo add and update in a sandbox.
See https://embarkstudios.github.io/cargo-deny/checks/bans/cfg.h...