News for hackers. Stuff that matters.
Re:Using Rust Macros to exfiltrate secrets by j4yav on Friday May 14, 2021 @01:07PM (#27156679)
Apart from running make which of course runs the makefile, under what scenario does viewing a makefile run it?
Re:Using Rust Macros to exfiltrate secrets by remram on Friday May 14, 2021 @01:22PM (#27156951)
Makefiles can actually be quite dynamic, so a program merely trying to figure out the list of target has to execute code. For example put this in a Makefile and do `make <TAB>`, the file will be created (no need to press enter):

    VALUE := $(shell touch /tmp/something)
Re:Using Rust Macros to exfiltrate secrets by JNRowe on Saturday May 15, 2021 @06:02AM (#27163884)
FWIW, while both bash and fish completion execute "make -n" for tab completion that isn't the case for zsh. zsh uses an internal parser for makefiles¹, and as such won't execute the shell function or recipes that use the + prefix.

¹ https://github.com/zsh-users/zsh/blob/master/Completion/Unix...

Re:Using Rust Macros to exfiltrate secrets by efaref on Friday May 14, 2021 @01:12PM (#27156769)
You're not just viewing it. You're opening it in an IDE which compiles it behind the scenes for you.

Many IDEs also do this for other languages (e.g. by running make), and the same problem applies.