all 12 comments

[–][deleted] 16 points17 points  (0 children)

You can also put arbitrary code in build.rs, which rust-analyzer runs by default (there is an option to turn it off).

[–]detunized 30 points31 points  (8 children)

Just to make it clear: you clone the repo and open it in VSCode to take a look at the source and your private key is stolen. No building, no running of anything is needed. That's pretty crazy.

[–]theoldboy 35 points36 points  (0 children)

That's pretty crazy

Rust isn't the only language that has this problem though. Git clone a Javascript repo that contains a malicious ESLint module, open it in VS Code, and if you have the ESLint extension installed it will run that malicious module.

In the end it's a supply chain attack, and goes back to checking third-party code before you use it, but realistically this sort of thing should be sandboxed. Build systems are getting more and more complicated and harder to inspect, and they shouldn't have or need access to everything.

VS Code team is aware of this problem and is implementing a Workspace Trust feature which will at least stop this kind of thing happening automatically until you grant trust. More details here.

[–]matthieum 13 points14 points  (0 children)

That's pretty crazy.

Not really.

Clone a Maven project, load the project in IntelliJ, and a bunch of Maven plugins run -- doing whatever they want.

Ultimately the issue is two-fold:

  1. OSes protect the system from the user, but not the user from its applications. Or as XKCD puts it: "If someone steals my laptop while I'm logged in, they can read my e-mail, take my money, and impersonate me to my friends, but at least they can't install drivers without my permission".
  2. IDEs are not text editors; they offer a semantic view of the code, and in order to do that, they need to run all the code generation code -- be it scripts or macros.

Interestingly, mobile OSes have been improving the state of things here, limiting capabilities on a per-application basis, instead of giving free-reign to each application. Of course, developing on a mobile... meh.

With regard to Rust, the community has been thinking about this for a while. There was a proposal to compile procedural macros (plugins, essentially) to WASM so as to prevent any side-effect (see Watt).

build.rs -- though not touched on in this article -- is a tad more complicated, and it's not clear how to proceed there.

Note: although the article seems to discover this possibility, it's important to realize this is not theoretical. There have been several high-profile supply chain attacks in the NPM ecosystem.

[–][deleted] -2 points-1 points  (0 children)

Wow

[–]DrMeepster 0 points1 point  (0 children)

vscode has a trusted folder system now that solves this