—

RUSTSEC-2021-0077

`better-macro` has deliberate RCE to prove a point

Details

[better-macro](https://crates.io/crates/better-macro) is a fake crate which is "Proving A Point" that proc-macros can run arbitrary code. This is not a particularly novel or interesting observation.

It currently opens `https://github.com/raycar5/better-macro/blob/master/doc/hi.md` which doesn't appear to have any malicious content, but there's no guarantee that will remain the case.

This crate has no useful functionality, and should not be used.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/better-macro

Introduced in: 0.0.0-0

No fixed version published yet for better-macro. Pin to a known-safe version or switch to an alternative.

References

https://crates.io/crates/better-macro[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2021-0077.html[ADVISORY]
https://github.com/raycar5/better-macro/blob/24ff1702397b9c19bbfa4c660e2316cd77d3b900/src/lib.rs#L36-L38[WEB]