Skip to content

Commit 8af7718

Browse files
authored
better-macro has deliberate RCE in proc-macro (#966)
It's "Proving A Point" in https://github.com/raycar5/better-macro/blob/master/doc/hi.md but there's no guarantee that this will remain benign (or is actually benign right now). The crate also has no useful functionality.
1 parent e20838a commit 8af7718

File tree

1 file changed

+27
-0
lines changed

1 file changed

+27
-0
lines changed
Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
```toml
2+
[advisory]
3+
id = "RUSTSEC-0000-0000"
4+
package = "better-macro"
5+
date = "2021-07-22"
6+
url = "https://github.com/raycar5/better-macro/blob/24ff1702397b9c19bbfa4c660e2316cd77d3b900/src/lib.rs#L36-L38"
7+
categories = ["code-execution"]
8+
keywords = ["rce", "proc-macro"]
9+
10+
[affected]
11+
functions = { "better_macro::println" = ["> 1.0.0"] }
12+
13+
[versions]
14+
patched = []
15+
```
16+
17+
# `better-macro` has deliberate RCE to prove a point
18+
19+
[better-macro](https://crates.io/crates/better-macro) is a fake crate which is
20+
"Proving A Point" that proc-macros can run arbitrary code. This a particularly
21+
novel or interesting observation.
22+
23+
It currently opens `https://github.com/raycar5/better-macro/blob/master/doc/hi.md`
24+
which doesn't appear to have any malicious content, but there's no guarantee that
25+
will remain the case.
26+
27+
This crate has no useful functionality, and should not be used.

0 commit comments

Comments
 (0)