Dynamic Loading and Injection: What are the ways that Rust allows code to be introduced at runtime?

[andymeneely]

Relevant CWEs:

https://cwe.mitre.org/data/definitions/94 Improper Control of Generation of Code ('Code Injection') https://cwe.mitre.org/data/definitions/96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') https://cwe.mitre.org/data/definitions/767 Access to Critical Private Variable via Public Method https://cwe.mitre.org/data/definitions/1123 Excessive Use of Self-Modifying Code

[blaqat]

There are no runtime code execution or dynamic code generation features in rust. Most vulnerabilities relating to this would be solved in compile time visibility, type, and ownership checks.

For CWE 94 and 96, there is no runtime code execution in rust. (e.g no runtime 'eval' like function) However input needs to be properly verified by the developer before used. e.g if for some reason you wanted a function to run any inputted terminal command and just passed in the user's input as the argument. So these are technically possible I believe if that counts as code injection.

CWE 767 is more related to modules I believe which shouldn't be possible due to variables needing to be marked as pub to be visible in public functions.

For CWE 1123, self modifying code is usually a last resort but it isn't blocked by rust, but it is also at compile time with macros not runtime.

[andymeneely]

Makes sense to me. I'm going to do some more digging on this. Dynamic linking might be a version of this. I want to document the places we looked for this one - since "there is no" could be something we overlooked.

[andymeneely]

(And this might be one that external people might have crazy ideas too)