From 7c3fcaa6d470998b9e7b779092e5c8e8a4f0a8c3 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 10:05:28 +0200 Subject: [PATCH 1/8] update main page --- content/_index.md | 1 - 1 file changed, 1 deletion(-) diff --git a/content/_index.md b/content/_index.md index d58b962..a9bb2a7 100644 --- a/content/_index.md +++ b/content/_index.md @@ -81,7 +81,6 @@ cover several other security-related topics. Stay tuned for updates from our tea ### Upcoming (!) - kAFL -- Rust - Formal verification and Tamarin ## Custom queries for static analysis tools From 66e8b5f266bcb427702a28ac666c107f292faf86 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 10:14:24 +0200 Subject: [PATCH 2/8] update coverage helper --- content/docs/languages/rust/20-dynamic-analysis.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/languages/rust/20-dynamic-analysis.md b/content/docs/languages/rust/20-dynamic-analysis.md index 1301c28..495e27c 100644 --- a/content/docs/languages/rust/20-dynamic-analysis.md +++ b/content/docs/languages/rust/20-dynamic-analysis.md @@ -669,7 +669,7 @@ Three popular tools wrap the above engines for easier consumption in Rust projec | Output format | LCOV, JSON, HTML, Cobertura, Coveralls+, Markdown, ADE | Text, LCOV, JSON, HTML, Cobertura, Codecov | Text, LCOV, JSON, HTML, XML | | To exclude files | `--ignore` | [`--ignore-filename-regex`](https://github.com/taiki-e/cargo-llvm-cov?tab=readme-ov-file#exclude-file-from-coverage) | `--exclude-files` | | To exclude functions | With in-code markers and regexes | [With attributes](https://github.com/taiki-e/cargo-llvm-cov?tab=readme-ov-file#exclude-code-from-coverage) | [With attributes](https://github.com/xd009642/tarpaulin?tab=readme-ov-file#ignoring-code-in-files) | -| To exclude test coverage | No | [With external module](https://github.com/taiki-e/coverage-helper/tree/v0.2.0) | `--ignore-tests` | +| To exclude test coverage | No | [Yes](https://github.com/taiki-e/cargo-llvm-cov/issues/123) | `--ignore-tests` | | To enable coverage for C/C++ | Unknown | [`--include-ffi`](https://github.com/taiki-e/cargo-llvm-cov?tab=readme-ov-file#get-coverage-of-cc-code-linked-to-rust-librarybinary) | Unknown | | Merges runs across different builds? | No | [Yes](https://github.com/taiki-e/cargo-llvm-cov?tab=readme-ov-file#merge-coverages-generated-under-different-test-conditions) | [Yes](https://github.com/xd009642/tarpaulin?tab=readme-ov-file#command-line) (but only shows delta) | From 3c575e3c45688bee0c66461625893ef7e82eeb35 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 10:27:35 +0200 Subject: [PATCH 3/8] revert 431ce57290aef2746c183bb0fae33ea8546b1176 --- content/docs/languages/rust/10-security-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/languages/rust/10-security-overview.md b/content/docs/languages/rust/10-security-overview.md index 65b01e5..0f17c20 100644 --- a/content/docs/languages/rust/10-security-overview.md +++ b/content/docs/languages/rust/10-security-overview.md @@ -8,7 +8,7 @@ weight: 10 ## Safety and security -The Rust compiler guarantees the memory safety of *safe* Rust: absent `unsafe` code, no undefined behavior or data race will happen during runtime, no matter the inputs. This guarantee does not extend to `unsafe` code—including `unsafe` code hidden in dependencies—which can cause undefined behavior if it is unsound. +The Rust compiler guarantees the memory safety of Rust: no undefined behavior or data race will happen during runtime, no matter the inputs. Therefore, when security-testing Rust programs, it’s important to understand what is and what is not considered undefined behavior (UB). There is no sense in looking for double-free bugs in (safe) Rust, right? For the guarantees made by the Rust compiler, see the ["Behavior considered undefined"](https://doc.rust-lang.org/reference/behavior-considered-undefined.html) Rust Reference page. From acbc56f20a7f6c10f5f4a5acda0864e4f2997403 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 10:35:43 +0200 Subject: [PATCH 4/8] partially revert a4bfc790570e49ed6b51739359057224cb84a705 --- content/docs/languages/rust/80-supply-chain-analysis.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/docs/languages/rust/80-supply-chain-analysis.md b/content/docs/languages/rust/80-supply-chain-analysis.md index e7fb9db..7e3cd95 100644 --- a/content/docs/languages/rust/80-supply-chain-analysis.md +++ b/content/docs/languages/rust/80-supply-chain-analysis.md @@ -135,9 +135,10 @@ cargo deny check bans --exclude-dev Look for `warning[duplicate]` outputs. {{< /hint >}} -Similarly, a dependency that is obtained from multiple sources (e.g., crates.io and github.com) may indicate some issues. To report such offending dependencies, use [`cargo-deny`](https://github.com/EmbarkStudios/cargo-deny)'s `sources` check. +Similarly, a dependency that is obtained from multiple sources (e.g., crates.io and github.com) may indicate some issues. To report such offending dependencies, use [`cargo vendor`](https://doc.rust-lang.org/cargo/commands/cargo-vendor.html) or `cargo-deny`'s `sources` check. ```sh +cargo vendor --locked ./tmp_path cargo deny check sources ``` From f16bf57df2809b702092be17ad6f57853fb3058c Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 10:41:03 +0200 Subject: [PATCH 5/8] fix skill framing --- content/docs/languages/rust/_index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/languages/rust/_index.md b/content/docs/languages/rust/_index.md index 7c251a5..806bfe0 100644 --- a/content/docs/languages/rust/_index.md +++ b/content/docs/languages/rust/_index.md @@ -30,6 +30,6 @@ u128|Box::new(std::iter::successors(Some(n),|&n|Some(n>>8) {{< /rawHtml >}} -Start your review with our [rust-review](https://github.com/trailofbits/skills/tree/main/plugins/rust-review) skill. It covers basic issues. +Start your review with [rust-review](https://github.com/trailofbits/skills/tree/main/plugins/rust-review) skill. It covers basic issues. {{< section >}} From adfbec2e149aaa6d2152524cebd44c1778f92320 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 10:45:52 +0200 Subject: [PATCH 6/8] fix links opening in coverage --- content/docs/languages/rust/20-dynamic-analysis.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/content/docs/languages/rust/20-dynamic-analysis.md b/content/docs/languages/rust/20-dynamic-analysis.md index 495e27c..cb3a5a8 100644 --- a/content/docs/languages/rust/20-dynamic-analysis.md +++ b/content/docs/languages/rust/20-dynamic-analysis.md @@ -679,9 +679,11 @@ Branch coverage from the LLVM source-based engine—the `branches` cells for `gr While checking coverage statistics from a command line and using one of many coverage visualizers, an HTML report is often what you need. + + | HTML output/tool | `grcov` | `llvm-cov` | `tarpaulin` | | :---- | :---- | :---- | :---- | -| Examples | [Open `grcov`]({{% staticref "/languages/rust/coverage/grcov_llvm/" %}}) [Open `grcov` with `lcov`]({{% staticref "/languages/rust/coverage/grcov_llvm_lcov/" %}}) | [Open `llvm-cov`]({{% staticref "/languages/rust/coverage/llvm_cov/" %}}) [Open `llvm-cov-pretty`]({{% staticref "/languages/rust/coverage/llvm_cov_pretty/" %}}) | [Open `tarpaulin`]({{% staticref "/languages/rust/coverage/tarpaulin-report.html" %}}) | +| Examples | [Open `grcov`]({{% staticref "/languages/rust/coverage/grcov_llvm/?:" %}}) [Open `grcov` with `lcov`]({{% staticref "/languages/rust/coverage/grcov_llvm_lcov/?:" %}}) | [Open `llvm-cov`]({{% staticref "/languages/rust/coverage/llvm_cov/?:" %}}) [Open `llvm-cov-pretty`]({{% staticref "/languages/rust/coverage/llvm_cov_pretty/?:" %}}) | [Open `tarpaulin`]({{% staticref "/languages/rust/coverage/tarpaulin-report.html?:" %}}) | | Handles Rust constructs? | Yes | Yes | Yes | | Expands Rust’s generics? | No | `--show-instantiations` | No | | Includes number of hits? | Yes | Yes | Yes | From e766fa550d9d573cd379895156d2910b09e3e168 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 10:50:38 +0200 Subject: [PATCH 7/8] clarify OsStr gotcha --- content/docs/languages/rust/40-gotchas.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/docs/languages/rust/40-gotchas.md b/content/docs/languages/rust/40-gotchas.md index 003283a..78f5227 100644 --- a/content/docs/languages/rust/40-gotchas.md +++ b/content/docs/languages/rust/40-gotchas.md @@ -18,7 +18,7 @@ This section provides a checklist that can be used during manual Rust code revie - [ ] Check string conversions to other data types (like `Vec`) and vice versa. These may come with UTF-8 encoding issues. Options for handling bytes that may not be valid UTF-8: - `from_utf8` with `unwrap`—strict, panics on non-convertible data - `from_utf8_lossy`—lossy, replaces invalid UTF-8 sequences with U+FFFD (replacement character) - - `OsStr`/`OsString`—for platform-native strings that may not be valid UTF-8 (e.g., paths, environment variables, and `argv`); it is not a UTF-8/bytes converter, and there is no portable way to get its raw bytes (`as_bytes` is Unix-only; `as_encoded_bytes` uses a non-portable encoding) + - `OsStr`/`OsString`—for platform-native strings; their `to_str` methods return None for non-UTF-8 data - [ ] Verify that the `with_capacity` method of the `Vec`, `HashMap`, `HashSet`, and `indexmap::IndexSet` types (and possibly other types) is not called with user-controlled data. Large values can lead to denial of service. - Also check that the provided capacity is smaller than the `isize::MAX` bytes [to prevent panics](https://doc.rust-lang.org/std/vec/struct.Vec.html#panics). - Note that some methods—[like Serde’s `size_hint`](https://github.com/serde-rs/serde/issues/744)—may indirectly expose the `with_capacity` method. From 563580377c19ace18ebcf84cd85e7df556ac1e59 Mon Sep 17 00:00:00 2001 From: GrosQuildu Date: Mon, 6 Jul 2026 12:16:24 +0200 Subject: [PATCH 8/8] rm cargo line test - archived --- content/docs/languages/rust/20-dynamic-analysis.md | 4 ---- 1 file changed, 4 deletions(-) diff --git a/content/docs/languages/rust/20-dynamic-analysis.md b/content/docs/languages/rust/20-dynamic-analysis.md index cb3a5a8..638e5c3 100644 --- a/content/docs/languages/rust/20-dynamic-analysis.md +++ b/content/docs/languages/rust/20-dynamic-analysis.md @@ -24,10 +24,6 @@ mod tests { Once you have the unit tests written and all of them pass, let’s improve on them. -{{< hint info >}} -To speed up the CI pipeline, use [`cargo-line-test`](https://github.com/trailofbits/cargo-line-test). It executes only the tests that exercise modified files and lines. It may be especially useful when using advanced but slow testing methods described later in this section. -{{< /hint >}} - ## Randomization ### Test order shuffling