Andrew Gallant ec6dbf077c crates/grep-cli: add advisory for arbitrary binary execution on Windows (#939) ...

* crates/grep-cli: add advisory for arbitrary binary execution on Windows

Ref https://github.com/BurntSushi/ripgrep/issues/1773

* drop commented out field

* crates/grep-cli: add more details about mitigation

Instead of dancing around it, we just say it: the main issue is that
std::process::Command will resolve relative binary names with respect to
the CWD first, because it just uses the Windows API for this.

More specifically, we call out the two particular mitigations that are
now in place.

Co-authored-by: Sergey "Shnatsel" Davidoff <shnatsel@gmail.com>

2021-06-15 00:42:25 +02:00

..

RUSTSEC-0000-0000.md

crates/grep-cli: add advisory for arbitrary binary execution on Windows (#939)

2021-06-15 00:42:25 +02:00