Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[stable] Destabilize the `Error::type_id` function #60785

Merged
merged 3 commits into from May 13, 2019

Conversation

Projects
None yet
6 participants
@alexcrichton
Copy link
Member

commented May 13, 2019

This commit destabilizes the Error::type_id function in the standard library.
This does so by effectively reverting #58048, restoring the #[unstable]
attribute. The security mailing list has recently been notified of a
vulnerability relating to the stabilization of this function. First stabilized
in Rust 1.34.0, a stable function here allows users to implement a custom
return value for this function:

struct MyType;

impl Error for MyType {
fn type_id(&self) -> TypeId {
    // Enable safe casting to `String` by accident.
    TypeId::of::<String>()
}
}

This, when combined with the Error::downcast family of functions, allows
safely casting a type to any other type, clearly a memory safety issue! A
formal announcement has been made to the security mailing list as well as the blog

This commit simply destabilizes the Error::type_id which, although breaking
for users since Rust 1.34.0, is hoped to have little impact and has been deemed
sufficient to mitigate this issue for the stable channel. The long-term fate of
the Error::type_id API will be discussed at #60784.

Destabilize the `Error::type_id` function
This commit destabilizes the `Error::type_id` function in the standard library.
This does so by effectively reverting #58048, restoring the `#[unstable]`
attribute. The security mailing list has recently been notified of a
vulnerability relating to the stabilization of this function. First stabilized
in Rust 1.34.0, a stable function here allows users to implement a custom
return value for this function:

    struct MyType;

    impl Error for MyType {
	fn type_id(&self) -> TypeId {
	    // Enable safe casting to `String` by accident.
	    TypeId::of::<String>()
	}
    }

This, when combined with the `Error::downcast` family of functions, allows
safely casting a type to any other type, clearly a memory safety issue! A
security announcement will be shortly posted to the security mailing list as
well as the Rust Blog, and when those links are available they'll be filled in
for this PR as well.

This commit simply destabilizes the `Error::type_id` which, although breaking
for users since Rust 1.34.0, is hoped to have little impact and has been deemed
sufficient to mitigate this issue for the stable channel. The long-term fate of
the `Error::type_id` API will be discussed at #60784.
@rust-highfive

This comment has been minimized.

Copy link
Collaborator

commented May 13, 2019

r? @bluss

(rust_highfive has picked a reviewer for you, use r? to override)

@rust-highfive

This comment has been minimized.

Copy link
Collaborator

commented May 13, 2019

⚠️ Warning ⚠️

  • Pull requests are usually filed against the master branch for this repo, but this one is against stable. Please double check that you specified the right target!
@alexcrichton

This comment has been minimized.

Copy link
Member Author

commented May 13, 2019

pietroalbini added some commits May 13, 2019

@pietroalbini

This comment has been minimized.

Copy link
Member

commented May 13, 2019

@bors r+ p=1000

@bors

This comment has been minimized.

Copy link
Contributor

commented May 13, 2019

📌 Commit bc8787c has been approved by pietroalbini

@bors

This comment has been minimized.

Copy link
Contributor

commented May 13, 2019

⌛️ Testing commit bc8787c with merge f024b31...

bors added a commit that referenced this pull request May 13, 2019

Auto merge of #60785 - alexcrichton:error-type-id-destabilize-stable,…
… r=pietroalbini

[stable] Destabilize the `Error::type_id` function

This commit destabilizes the `Error::type_id` function in the standard library.
This does so by effectively reverting #58048, restoring the `#[unstable]`
attribute. The security mailing list has recently been notified of a
vulnerability relating to the stabilization of this function. First stabilized
in Rust 1.34.0, a stable function here allows users to implement a custom
return value for this function:

    struct MyType;

    impl Error for MyType {
	fn type_id(&self) -> TypeId {
	    // Enable safe casting to `String` by accident.
	    TypeId::of::<String>()
	}
    }

This, when combined with the `Error::downcast` family of functions, allows
safely casting a type to any other type, clearly a memory safety issue! A
security announcement will be shortly posted to the security mailing list as
well as the Rust Blog, and when those links are available they'll be filled in
for this PR as well.

This commit simply destabilizes the `Error::type_id` which, although breaking
for users since Rust 1.34.0, is hoped to have little impact and has been deemed
sufficient to mitigate this issue for the stable channel. The long-term fate of
the `Error::type_id` API will be discussed at #60784.
@Centril

This comment has been minimized.

Copy link
Member

commented May 13, 2019

@bors treeclosed=500

@bors

This comment has been minimized.

Copy link
Contributor

commented May 13, 2019

💔 Test failed - checks-travis

@rust-highfive

This comment has been minimized.

Copy link
Collaborator

commented May 13, 2019

The job dist-x86_64-apple-alt of your PR failed on Travis (raw log). Through arcane magic we have determined that the following fragments from the build log may contain information about the problem.

Click to expand the log.
voltdb
wry
zxing-cpp
==> Downloading https://homebrew.bintray.com/bottles/xz-5.2.4.high_sierra.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/e7/e7be50f4ee00e35887f3957263334eb3baba59e8c061919060f9259351be6880?__gda__=exp=1557763362~hmac=79dda960b6c4cc8145822acf15110112fc3c67411361a3cf34c896880e0953fb&response-content-disposition=attachment%3Bfilename%3D%22xz-5.2.4.high_sierra.bottle.tar.gz%22&response-content-type=application%2Fgzip&requestInfo=U2FsdGVkX1_zm97EuJ2t3NMxfLCHKgc89ORVJedDyIhnMzXfcg4lRXXqf55mjisNQ-gQYoI5reQlC7FcCjUjLpTNOPEe7f5tMHSRLAH3h2lOg9n3n-uED-egLWETcY9ckQBKxumHLCt9cbSZfGpvZw&response-X-Checksum-Sha1=32dc0b28e61f32b40c20e2993418aa8cb6e746d5&response-X-Checksum-Sha2=e7be50f4ee00e35887f3957263334eb3baba59e8c061919060f9259351be6880
🍺  /usr/local/Cellar/xz/5.2.4: 92 files, 1MB
==> `brew cleanup` has not been run in 30 days, running now...
Removing: /Users/travis/Library/Caches/Homebrew/boost-1.66.0.high_sierra.bottle.tar.gz... (84.6MB)
Removing: /Users/travis/Library/Caches/Homebrew/carthage-0.28.0.high_sierra.bottle.tar.gz... (8.3MB)
---
Pruned 0 symbolic links and 5 directories from /usr/local
==> Installing dependencies for swig: pcre
==> Installing swig dependency: pcre
==> Downloading https://homebrew.bintray.com/bottles/pcre-8.43.high_sierra.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/03/0389911a93a88efd4a69b52dea8ecb872fdb55bcfff45d2f7313be5f79730861?__gda__=exp=1557763377~hmac=263c6a40f85755198512e69220a92dc68efe3d1e716856746ba4eb1d3f854085&response-content-disposition=attachment%3Bfilename%3D%22pcre-8.43.high_sierra.bottle.tar.gz%22&response-content-type=application%2Fgzip&requestInfo=U2FsdGVkX18vNlHxKWxBOoYjWQfj_hlOaPgVQejFmPvib_O2HFL-9YLINLDo_ll9E6zALS9Qczpfc-_w6lGlqgKke8A-uOkY7FxCMaBSAF5_c8PCIC41y2ASanvvACkbaZCnQ3-mFu6k4zRMNHdDmg&response-X-Checksum-Sha1=c67d4b99bb245f0ea56b34118dd6325b06a7250c&response-X-Checksum-Sha2=0389911a93a88efd4a69b52dea8ecb872fdb55bcfff45d2f7313be5f79730861
🍺  /usr/local/Cellar/pcre/8.43: 204 files, 5.5MB
==> Installing swig
==> Downloading https://homebrew.bintray.com/bottles/swig-4.0.0.high_sierra.bottle.tar.gz
==> Downloading https://homebrew.bintray.com/bottles/swig-4.0.0.high_sierra.bottle.tar.gz
==> Downloading from https://akamai.bintray.com/ae/aed79cb436b3a0ac5812c4085e3121ffd62866397b8c7eaa06815ed8ec1e22b7?__gda__=exp=1557763380~hmac=9d1ca94fa1025bb7302439563b2dc4451968da3172e59adca547fad3933c02b2&response-content-disposition=attachment%3Bfilename%3D%22swig-4.0.0.high_sierra.bottle.tar.gz%22&response-content-type=application%2Fgzip&requestInfo=U2FsdGVkX18zo3aka1HYf0lxMwzYLb6yWgZEr0QMXjb2XrcRba5XvsJGwvteUyAnCqSvYc4WXE5MzMPKb98fFoC-oI_LFbZlEUfs5mI6y82YL7e4wGmw9MlW9ALinm2iei5Y6IacVRVP_dhqeDwd0w&response-X-Checksum-Sha1=a9c428aee4337d91061a69c02d7ae508b627d03f&response-X-Checksum-Sha2=aed79cb436b3a0ac5812c4085e3121ffd62866397b8c7eaa06815ed8ec1e22b7
🍺  /usr/local/Cellar/swig/4.0.0: 722 files, 5.4MB
travis_time:end:003bf65f:start=1557762308413372000,finish=1557762699365727000,duration=390952355000
travis_fold:end:install
travis_fold:start:before_script.1
---
[00:03:13]       Memory: 8 GB
[00:03:13]       Boot ROM Version: VMW71.00V.7581552.B64.1801142334
[00:03:13]       Apple ROM Info: [MS_VM_CERT/SHA1/27d66596a61c48dd3dc7216fd715126e33f59ae7]Welcome to the Virtual Machine
[00:03:13]       SMC Version (system): 2.8f0
[00:03:13]       Serial Number (system): VMO0CHZm9xsq
[00:03:13] 
[00:03:13] hw.ncpu: 4
[00:03:13] hw.byteorder: 1234
[00:03:13] hw.memsize: 8589934592
---
Building stage2 tool cargo (x86_64-apple-darwin)
[01:29:40]  Downloading crates ...
[01:29:40] warning: spurious network error (2 tries remaining): [6] Couldn't resolve host name (Could not resolve host: crates.io)
[01:29:40] warning: spurious network error (1 tries remaining): [6] Couldn't resolve host name (Could not resolve host: crates.io)
[01:29:40] error: failed to download from `https://crates.io/api/v1/crates/openssl-src/111.1.0+1.1.1a/download`
[01:29:40] Caused by:
[01:29:40]   [6] Couldn't resolve host name (Could not resolve host: crates.io)
[01:29:40] command did not execute successfully: "/Users/travis/build/rust-lang/rust/build/x86_64-apple-darwin/stage0/bin/cargo" "build" "--target" "x86_64-apple-darwin" "-j" "4" "--release" "--locked" "--color" "always" "--manifest-path" "/Users/travis/build/rust-lang/rust/src/tools/cargo/Cargo.toml" "--features" "rustc-workspace-hack/all-static" "--message-format" "json"
[01:29:40] expected success, got: exit code: 101
---
travis_fold:start:after_failure.2
travis_time:start:04e33996
$ ls -lat $HOME/Library/Logs/DiagnosticReports/
total 0
drwx------+ 15 travis  staff  510 Jan 25  2018 ..
drwx------   2 travis  staff   68 Dec  6  2017 .
travis_fold:end:after_failure.2
travis_fold:start:after_failure.3
travis_time:start:0a602db5
$ find $HOME/Library/Logs/DiagnosticReports -type f -name '*.crash' -not -name '*.stage2-*.crash' -not -name 'com.apple.CoreSimulator.CoreSimulatorService-*.crash' -exec printf travis_fold":start:crashlog\n\033[31;1m%s\033[0m\n" {} \; -exec head -750 {} \; -exec echo travis_fold":"end:crashlog \; || true
$ find $HOME/Library/Logs/DiagnosticReports -type f -name '*.crash' -not -name '*.stage2-*.crash' -not -name 'com.apple.CoreSimulator.CoreSimulatorService-*.crash' -exec printf travis_fold":start:crashlog\n\033[31;1m%s\033[0m\n" {} \; -exec head -750 {} \; -exec echo travis_fold":"end:crashlog \; || true
travis_time:end:0a602db5:start=1557768087501760000,finish=1557768087533273000,duration=31513000
travis_fold:end:after_failure.3
travis_fold:start:after_failure.4
travis_time:start:0014707b
$ ln -s . checkout && for CORE in obj/cores/core.*; do EXE=$(echo $CORE | sed 's|obj/cores/core\.[0-9]*\.!checkout!\(.*\)|\1|;y|!|/|'); if [ -f "$EXE" ]; then printf travis_fold":start:crashlog\n\033[31;1m%s\033[0m\n" "$CORE"; gdb --batch -q -c "$CORE" "$EXE" -iex 'set auto-load off' -iex 'dir src/' -iex 'set sysroot .' -ex bt -ex q; echo travis_fold":"end:crashlog; fi; done || true
travis_fold:end:after_failure.4
travis_fold:start:after_failure.5
travis_time:start:2762cdc0
travis_time:start:2762cdc0
$ cat ./obj/build/x86_64-unknown-linux-gnu/native/asan/build/lib/asan/clang_rt.asan-dynamic-i386.vers || true
cat: ./obj/build/x86_64-unknown-linux-gnu/native/asan/build/lib/asan/clang_rt.asan-dynamic-i386.vers: No such file or directory
travis_fold:end:after_failure.5
travis_fold:start:after_failure.6
travis_time:start:32c4ea40
$ dmesg | grep -i kill
$ dmesg | grep -i kill
Unable to obtain kernel buffer: Operation not permitted
usage: sudo dmesg
travis_fold:end:after_failure.6

Done. Your build exited with 1.

I'm a bot! I can only do what humans tell me to, so if this was not helpful or you have suggestions for improvements, please ping or otherwise contact @TimNN. (Feature Requests)

@alexcrichton

This comment has been minimized.

Copy link
Member Author

commented May 13, 2019

@bors: retry

network error

@bors

This comment has been minimized.

Copy link
Contributor

commented May 13, 2019

⌛️ Testing commit bc8787c with merge 6c2484d...

bors added a commit that referenced this pull request May 13, 2019

Auto merge of #60785 - alexcrichton:error-type-id-destabilize-stable,…
… r=pietroalbini

[stable] Destabilize the `Error::type_id` function

This commit destabilizes the `Error::type_id` function in the standard library.
This does so by effectively reverting #58048, restoring the `#[unstable]`
attribute. The security mailing list has recently been notified of a
vulnerability relating to the stabilization of this function. First stabilized
in Rust 1.34.0, a stable function here allows users to implement a custom
return value for this function:

    struct MyType;

    impl Error for MyType {
	fn type_id(&self) -> TypeId {
	    // Enable safe casting to `String` by accident.
	    TypeId::of::<String>()
	}
    }

This, when combined with the `Error::downcast` family of functions, allows
safely casting a type to any other type, clearly a memory safety issue! A
formal announcement has been made to the [security mailing list](https://groups.google.com/forum/#!topic/rustlang-security-announcements/aZabeCMUv70) as well as [the blog](https://blog.rust-lang.org/2019/05/13/Security-advisory.html)

This commit simply destabilizes the `Error::type_id` which, although breaking
for users since Rust 1.34.0, is hoped to have little impact and has been deemed
sufficient to mitigate this issue for the stable channel. The long-term fate of
the `Error::type_id` API will be discussed at #60784.
@bors

This comment has been minimized.

Copy link
Contributor

commented May 13, 2019

☀️ Test successful - checks-travis, status-appveyor
Approved by: pietroalbini
Pushing 6c2484d to stable...

@bors bors added the merged-by-bors label May 13, 2019

@bors bors merged commit bc8787c into rust-lang:stable May 13, 2019

2 checks passed

Travis CI - Pull Request Build Passed
Details
homu Test successful
Details

netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request May 14, 2019

he
Update rust to version 1.34.2.
Pkgsrc changes: basically none.

Upstream changes:

Version 1.34.2 (2019-05-14)
===========================

* [Destabilize the `Error::type_id` function due to a security
   vulnerability][60785]

[60785]: rust-lang/rust#60785

netbsd-srcmastr pushed a commit to NetBSD/pkgsrc that referenced this pull request May 19, 2019

he
Update rust to version 1.34.2.
Pkgsrc changes: basically none.

Upstream changes:

Version 1.34.2 (2019-05-14)
===========================

* [Destabilize the `Error::type_id` function due to a security
   vulnerability][60785]

[60785]: rust-lang/rust#60785
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.