[Security] Vulnerability report

[Ry0taK]

I've sent an email that contains the detail of the vulnerability to . (As I couldn't find proper contact information to report a vulnerability, I used the email from https://blog.burntsushi.net/about/)
Since I believe this vulnerability can be exploited, I'm not publishing the detail here.

@BurntSushi Can you check the inbox, please?

[BurntSushi]

Thanks! That email is fine. I'm investigating it, but since it only happens on Windows, it will take me some time to get to it.

[BurntSushi]

Also fixed by 229d1a8.

[Ry0taK]

@BurntSushi Thank you so much for fixing this issue ;)

[xfbs]

This almost sounds like a bug in Windows or std::process::Command to me. Other people that are used to *nix might find this behaviour surprising and introduce similar vulnerabilities. Should this be fixed in the stdlib maybe? Maybe have some method on a Command that optionally resolves the path to an executable like your resolve_binary, overriding the OS's search path (skipping the current working directory)? Just some food for thought (duplicated here because comments on commits might not be the best place).

[BurntSushi]

I meant a file a bug against std. The library team did have a brief private conversation about it a couple months ago, and there does seem to be some appetite toward doing something here.

I haven't gotten around to filing an issue, but we are okay doing it publicly. So anyone can create that issue. (And I would invite someone to do it.)

See also: golang/go#38736

[BurntSushi]

Note also that I created a CVE for this: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3013

(I sent mail to them to publish the CVE today, so that's pending.)

[Shnatsel]

Does this also affect ripgrep being used as a crate? If so, it's probably a good idea to also file an advisory at https://github.com/RustSec/advisory-db - that way people relying on a vulnerable version would be notified through cargo audit, cargo deny, etc.

[BurntSushi]

@Shnatsel Good idea. You're correct!

Done: rustsec/advisory-db#939