Colin

The problem to me is that it's not expected for a command line argument to potentially execute arbitrary code. So one could imagine this program ```rust use std::process::Command; fn main()...

Maybe as a further example, let's imagine that `ripgrep` used `nameless`. Since `vscode` shells out to it an attacker would only need to control a file name argument that gets...

Yeah, my examples are sort of contrived. A more brutal example of this sort of thing would be log4j, where an attacker controlled a string and, unexpectedly, that string was...

Another idea: ```rust #[declare(rhai=( fn append(a, b) { return a + b; } )) fn append(s: &str, o: &str) -> { format!("{s}{o}") } ``` In this case `rhai` is describing...

Rhai might also help with custom effects. I haven't decided what the "base" effects are or what exactly an effect will map to. I think *probably* it's up to the...

I think this crate was built pre-stable-serde, so rustc was chosen. If you submit a patch that adds serde support, I'll happily review and accept it (I think I can...

It would be nice to fail gracefully here. Sometimes an action will install deps, sometimes it won't - right now this bug means you have to completely forgo caching via...

This will likely imply some new container types, potentially including a `Trusted` container with full capabilities. 1. `Trusted` - `new`, `init`, `add`, `clean` 2. `Exec` - `bench`, `test`, `run` 3....

Currently there's a `Build` and `Publish` container, the idea being that they each have their own needs. I think this can actually be generalized to a sort of `RW^X` model....

It's also probably fine to say that "cargo publish is an advanced case and cargo-sandbox's attempt to isolate the api key is best-effort, ultimately it's the rest of the host...