New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Rust 1.58 solves command execution vulnerability #2027

Open

sharkdp opened this issue Jan 15, 2022 · 1 comment

Labels

waiting-on-msrv

Owner

sharkdp commented Jan 15, 2022 •

edited

Loading

The Rust 1.58 release notes (https://blog.rust-lang.org/2022/01/13/Rust-1.58.0.html#reduced-windows-command-search-path) mention, that the problem with command execution on Windows that lead to #1472 / CVE-2021-36753 have now been fixed.

This should allow us to remove the custom ripgrep-based bugfix (#1724) once we switch to Rust 1.58.

Owner Author

sharkdp commented Jan 15, 2022

We could use a mechanism similar to https://github.com/sharkdp/fd/blob/125cb81a5bc7b35005fbc9299052763d682915c1/build.rs#L10-L19 to make sure that bat would not be compiled with rustc versions smaller than 1.58.

Enselic added the waiting-on-msrv label

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment