File tree 1 file changed +27
-0
lines changed
1 file changed +27
-0
lines changed Original file line number Diff line number Diff line change
1
+ ``` toml
2
+ [advisory ]
3
+ id = " RUSTSEC-0000-0000"
4
+ package = " better-macro"
5
+ date = " 2021-07-22"
6
+ url = " https://github.com/raycar5/better-macro/blob/24ff1702397b9c19bbfa4c660e2316cd77d3b900/src/lib.rs#L36-L38"
7
+ categories = [" code-execution" ]
8
+ keywords = [" rce" , " proc-macro" ]
9
+
10
+ [affected ]
11
+ functions = { "better_macro::println" = [" > 1.0.0" ] }
12
+
13
+ [versions ]
14
+ patched = []
15
+ ```
16
+
17
+ # ` better-macro ` has deliberate RCE to prove a point
18
+
19
+ [ better-macro] ( https://crates.io/crates/better-macro ) is a fake crate which is
20
+ "Proving A Point" that proc-macros can run arbitrary code. This a particularly
21
+ novel or interesting observation.
22
+
23
+ It currently opens ` https://github.com/raycar5/better-macro/blob/master/doc/hi.md `
24
+ which doesn't appear to have any malicious content, but there's no guarantee that
25
+ will remain the case.
26
+
27
+ This crate has no useful functionality, and should not be used.
You can’t perform that action at this time.
0 commit comments