Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example

Offen
  • Stimmt etwas nicht?
#1,933 1 Kommentar 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Maintainer antworten meist innerhalb von 1 Tag

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
50/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
rust
Bereich
security

Rechercherichtung

Start with CargoLock::entries in crates/socket-patch-core/src/formats/cargo/mod.rs (around L483) and add a failing unit test with the index.crates.io.evil.example and github.com/rust-lang/crates.io-index-fork lookalikes. Then read the other three sites: vendor/cargo.rs (L576), patch/redirect/mod.rs (L2451), vendor/cargo_manifest.rs (L78), plus the CRATES_IO_SOURCE const in redirect/upstream/cargo.rs. Done means one is_crates_io_source helper is called from all four sites, the local copies are gone, and the cargo lock and vendor cargo tests pass.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

agent:triaged arch-audit bug priority:p2

[agent] Filed by the scheduled architecture audit (audit-core). Register: register.

Kind: bug (duplicated rule that drifted). Register ID: A55.

Problem

Whether a Cargo.lock source is crates.io is decided in four places, by three different rules:

Site Rule
formats/cargo/mod.rs L483-L484 (CargoLock::entries) substring: source.contains("github.com/rust-lang/crates.io-index") || source.contains("index.crates.io")
vendor/cargo.rs L576-L577 two exact strings
patch/redirect/mod.rs L2451-L2461 normalized (case, registry+/sparse+, trailing /, .git)
vendor/cargo_manifest.rs L78-L87 the [patch]-key variant

There is also a CRATES_IO_SOURCE const in redirect/upstream/cargo.rs L25.```

Executed (a scratch copy at cbbbdb9): a lock entry with source = "sparse+https://index.crates.io.evil.example/" gets SourceKind::CratesIo and a Sha256Hex verifier from CargoLock::entries. Downstream, VEX discovery treats it as crates.io (vex/discover/mod.rs L2942).

Proposed change

Add one formats::cargo::is_crates_io_source(&str) -> bool next to is_registry_source. It uses the normalized rule from redirect/mod.rs, plus the [patch]-key spelling. Call it from all four sites, and delete the local copies and CRATES_IO_SOURCE.

Size

5 files, about −30/+20 lines.

Acceptance criteria

  • A unit table test covers both canonical spellings, case and trailing-slash variants, and the index.crates.io.evil.example and github.com/rust-lang/crates.io-index-fork lookalikes (both rejected).
  • The cargo lock equivalence tests and vendor cargo tests pass.
Vorherrschende Sprache
Rust
Sterne
9
Forks
2
Ø Merge
20 Std. 47 Min.
Gemergte PRs (30 T.)
681

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus SocketDev/socket-patch

Alle Issues in SocketDev/socket-patch

Ähnliche Issues

Weitere Issues zu Rust

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.