it’s a windows vulnerability not rust, haskell also send a patch to fix it
I’d say it’s more like it demonstrates how quirky the requirements are that Haskell also failed to get it right. The error and the fix are both in Rust code.
It’s a bit arguing about semantics really. But Rust and Haskell are merely the first ones with patches out. The issue affects other languages as well, including Java, Node.js, Python and seemingly every language with Windows support. I think it’s fair to call it a Windows problem, since it affects everyone there.
But languages like Rust and Haskell are promising their users that they are protected from this kind of behavior, which is why they want to patch it quickly. Some of the others merely updated the documentation, effectively saying yeah it’s a risk. Java went as far as saying they won’t fix the issue.
This, btw, is why CVE scores are insane at times.
The vulnerability is that when spawning a new process which is a bat file you need special treatment of the arguments to avoid spawning a second process.
So you need a rust program setup to spawn other processes which also somehow forwards unparsed user input into those processes and is executing a bat file.
There’s a reason nobody has fixed this, it’s because it’s an insane setup that affects basically no rust programs.
Here’s a better article: https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/
