Mitigation for dependency confusion attack caused by lack of --registry arg

[kornelski]

Cargo and cargo-edit aren't technically vulnerable to the dependency confusion attack the way other registries are, but there is a possibility of a human error if user adds a dependency and forgets to specify they've meant to add it from an alternative registry. Because dependencies can run code in build.rs, a planted dependency could exploit the confusion even if it couldn't build properly.

The scenario is:

1. Attacker figures out that a company uses company-internal-utils crate from their private registry
2. Attacker publishes malicious company-internal-utils on crates.io
3. Someone at the company eventually makes a mistake and runs cargo add company-internal-utils instead of cargo add company-internal-utils --registry=internal

I propose to mitigate this risk by detecting when the same name is in both crates.io and any alternative registry that Cargo knows about, and treating such dependencies as ambiguous if they're added without an explicit --registry arg.

cargo add company-internal-utils

error: `company-internal-utils` exists in both "internal" and "crates.io" registries. 
Please specify which registry should be used:

cargo add company-internal-utils --registry=internal
or
cargo add company-internal-utils --registry=crates.io

(same issue for Cargo)

[epage]

Moved to rust-lang/cargo#10656