An intro to the world of auditing Rust code
summary
Shows concrete Rust bugs and fixes: a dev-server passes unchecked paths to fs::read causing a directory traversal fixed by canonicalizing and scoping reads; predictable sequential U32 resource IDs let one window enumerate and access another window’s files, mitigated by randomizing IDs (and ideally separate per-window tables) — resource ID guessing; a Rosenpass handler panics on an out‑of‑range zero‑copy slice access during quantum‑resistant key exchange, fixed by a single truncating length check. Recommends using Clippy, cargo-audit, cargo-fuzz, Miri, Loom and libAFL.
AI-written summary · about
chapters (6)
- 0:00Introduction
- 1:04Fundamentals of appsec
- 6:57Secure software development
- 10:34Real-world bug examples
- 18:39Security tooling and strategy
- 22:34Q&A and concluding remarks
related talks
45mBuilding Safe and Secure Systems in Rust
19mCounterexamples in Safe Rust
18mAuditing Rust Crates Effectively
14mAn Empirical Study of Bugs in the rustc Compiler
27mHow Rust taught me to think about systems
58mRust for The Curious C++ Developers
30msub0 Asia 2024 - Mohammadreza Ashouri
50mConfessions of a Rusty Java developer