GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example · Issue #1933 · SocketDev/socket-patch

Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example #1933

New issue
Copy link
New issue
Copy link
Open
Open
Decide "is this source crates.io" in one helper: CargoLock::entries uses a substring test that accepts index.crates.io.evil.example#1933
Copy link
Labels
agent:triagedarch-auditFiled by a scheduled architecture audit routine (see the architecture review discussion)Filed by a scheduled architecture audit routine (see the architecture review discussion)bugSomething isn't workingSomething isn't workingpriority:p2

Description

@mikolalysenko
Mikola Lysenko (mikolalysenko)
opened on Nov 1, 2026
Issue body actions

[agent] Filed by the scheduled architecture audit (audit-core). Register: register.

Kind: bug (duplicated rule that drifted). Register ID: A55.

Problem

Whether a Cargo.lock source is crates.io is decided in four places, by three different rules:

Site Rule
formats/cargo/mod.rs L483-L484 (CargoLock::entries) substring: source.contains("github.com/rust-lang/crates.io-index") || source.contains("index.crates.io")
vendor/cargo.rs L576-L577 two exact strings
patch/redirect/mod.rs L2451-L2461 normalized (case, registry+/sparse+, trailing /, .git)
vendor/cargo_manifest.rs L78-L87 the [patch]-key variant

There is also a CRATES_IO_SOURCE const in redirect/upstream/cargo.rs L25.```

Executed (a scratch copy at cbbbdb9): a lock entry with source = "sparse+https://index.crates.io.evil.example/" gets SourceKind::CratesIo and a Sha256Hex verifier from CargoLock::entries. Downstream, VEX discovery treats it as crates.io (vex/discover/mod.rs L2942).

Proposed change

Add one formats::cargo::is_crates_io_source(&str) -> bool next to is_registry_source. It uses the normalized rule from redirect/mod.rs, plus the [patch]-key spelling. Call it from all four sites, and delete the local copies and CRATES_IO_SOURCE.

Size

5 files, about −30/+20 lines.

Acceptance criteria

  • A unit table test covers both canonical spellings, case and trailing-slash variants, and the index.crates.io.evil.example and github.com/rust-lang/crates.io-index-fork lookalikes (both rejected).
  • The cargo lock equivalence tests and vendor cargo tests pass.

Activity

  1. Mikola Lysenko (mikolalysenko)
    added
    bugSomething isn't workingSomething isn't working
    arch-auditFiled by a scheduled architecture audit routine (see the architecture review discussion)Filed by a scheduled architecture audit routine (see the architecture review discussion)
    agent:triaged
    priority:p2
    on Nov 1, 2026

  2. mikolalysenko commented on Nov 1, 2026

    @mikolalysenko
    Mikola Lysenko (mikolalysenko)
    on Nov 1, 2026
    CollaboratorAuthor
    More actions

    [agent] Triage: priority:p2 (Cargo). No open PR covers it.

    Generated by Claude Code

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    agent:triagedarch-auditFiled by a scheduled architecture audit routine (see the architecture review discussion)Filed by a scheduled architecture audit routine (see the architecture review discussion)bugSomething isn't workingSomething isn't workingpriority:p2

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.