Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Item shadowing #38

Open
burdges opened this issue Jun 15, 2020 · 3 comments
Open

Item shadowing #38

burdges opened this issue Jun 15, 2020 · 3 comments

Comments

@burdges
Copy link

burdges commented Jun 15, 2020

Are we concerned about item shadowing? Do we want lints that forbid shadowing?

At a technical level, item shadowing might not create so many new threats per se, but they simplify innocent looking bug doors.

It remains unclear to me if rust-lang/rfcs#2845 makes the item shadowing situation better or worse.

@Shnatsel
Copy link
Member

Item shadowing is a double-edged sword. Intentional use for removing variables you don't want to use accidentally is great. On the other hand, accidental shadowing may cause issues.

I don't recall any RustSec advisories for issues caused by shadowing, for what it's worth. Neither do I recall any in the fuzzing trophy case, but I can't remember all of those for sure.

IIRC there is a clippy lint that makes any kind of shadowing a warning.

@kpcyrd
Copy link

kpcyrd commented Jun 16, 2020

I usually use shadowing when I get something like Result<Option<T>> and I actually want a T. There used to be an underhanded-rust contest going on, maybe it's time to do another round. :)

@burdges
Copy link
Author

burdges commented Jun 16, 2020

I'd think such attacks live only in NPM land still, but we've so much large crypto-currency software being written in rust that bug door attacks using shadowing sound plausible eventually.

IIRC there is a clippy lint that makes any kind of shadowing a warning.

Any? We do not care about local variable shadowing, only cross-crate method shadowing. We can close this issue if clippy can do methods only. We've some cargo tool to run clippy on dependencies?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants