~lobsters | Bookmarks (4)

A few weeks ago, I got a bit miffed reading yet another article that was too dismissive about memory safety, basically being mostly dismissive about the need for change. The following weekend, I started seeing flippant responses from security luminaries, saying essentially that you’re irresponsible and dangerous unl...

Apr. 9, 2024 · The Rust Security Response WG The Rust Security Response WG was notified that the Rust standard library did not properly escape arguments when invoking batch files (with the bat and cmd extensions) on Windows using the Command API. An attacker able to control the arguments passed to the spawned proces...