Rust的安全幻影：语言层面的约束及其局限性

const { spawn } = require('child_process');
const child = spawn('echo', ['hello', 'world']);

/*
 * Quotes command line arguments
 * Returns a pointer to the end (next char to be written) of the buffer
 */
WCHAR* quote_cmd_arg(const WCHAR *source, WCHAR *target) {
/*
   * Expected input/output:
   *   input : hello"world
   *   output: "hello\"world"
    *   output: "hello world\\"
*/
}

echo "hello" "world"

const { spawn } = require('child_process');
const child = spawn('./test.bat', ['"&calc.exe']);

cmd.exe /c ""test.bat "\"&calc.exe"

cmd.exe /c ""test.bat ""&calc.exe"

cmd.exe /c test.bat "^"^&calc.exe"

pub(crate) fn make_bat_command_line(
    script: &[u16],
    args: &[Arg],
    force_quotes: bool,
) -> io::Result<Vec<u16>> {
    // Set the start of the command line to `cmd.exe /c "`
    // It is necessary to surround the command in an extra pair of quotes,
    // hence the trailing quote here. It will be closed after all arguments
    // have been added.
    let mut cmd: Vec<u16> = "cmd.exe /d /c \"".encode_utf16().collect();

    // skip some code
    for arg in args {
        cmd.push(' ' as u16);
        // Make sure to always quote special command prompt characters, including:
        // * Characters `cmd /?` says require quotes.
        // * `%` for environment variables, as in `%TMP%`.
        // * `|<>` pipe/redirect characters.
        const SPECIAL: &[u8] = b"\t &()[]{}^=;!'+,`~%|<>";
        let force_quotes = match arg {
            Arg::Regular(arg) if !force_quotes => arg.bytes().iter().any(|c| SPECIAL.contains(c)),
            _ => force_quotes,
        };
        append_arg(&mut cmd, arg, force_quotes)?;
    }
}

fn append_arg() 

    for x in arg.encode_wide() {
        if escape {
            if x == '\\' as u16 {
                backslashes += 1;
            } else {
                if x == '"' as u16 {
                    // Add n+1 backslashes to total 2n+1 before internal '"'.
                    cmd.extend((0..=backslashes).map(|_| '\\' as u16));
                }
                backslashes = 0;
            }
        }
        cmd.push(x);
    }

use std::io::{self, Write};
use std::process::Command;

fn main() {
    println!("enter payload here");
    let mut input = String::new();
    io::stdout().flush().expect("Failed to flush stdout");
    io::stdin().read_line(&mut input).expect("Failed to read from stdin");
    let output = Command::new("./test.bat")
                         .arg(input.trim())
                         .output()
                         .expect("Failed to execute command");
    println!("Output:\n{}", String::from_utf8_lossy(&output.stdout));
}

cmd.exe /d /c ""D:\CVE-2024-24576\target\debug\test.bat" "\"&calc.exe""

// Loop through the string, escaping `\` only if followed by `"`.
    // And escaping `"` by doubling them.
    let mut backslashes: usize = 0;
    for x in arg.encode_wide() {
        if x == '\\' as u16 {
            backslashes += 1;
        } else {
            if x == '"' as u16 {
                // Add n backslashes to total 2n before internal `"`.
                cmd.extend((0..backslashes).map(|_| '\\' as u16));
                // Appending an additional double-quote acts as an escape.
                cmd.push(b'"' as u16);
            }
        }
    }

struct TestStruct {
    field1: u8,
    field2: u32,
    field3: u16,
}

struct test
{
  char a;
  int  b;
  short c;
};

struct TestStruct {
    field1: u8,
    field2: u32,
    field3: u16,
}

    let foo = TestStruct {
        field1: 12,
        field2: 3, // Using u32 to store char as its ULE representation
        field3: 456,
    };
    println!("Size of TestStruct: {}", size_of::<TestStruct>());
    println!("Offset of 'field1': {}", offset_of!(TestStruct, field1));
    println!("Offset of 'field2': {}", offset_of!(TestStruct, field2));
    println!("Offset of 'field3': {}", offset_of!(TestStruct, field3));


Size of TestStruct: 8
Offset of 'field1': 6
Offset of 'field2': 0
Offset of 'field3': 4

TestStruct[6] = 12;
*(_DWORD *)TestStruct = 3;
*(_WORD *)&TestStruct[4] = 456;

#[repr(C)]

#[repr(packed)]

pub unsafe trait ULE 
where
    Self: Sized + Copy + 'static, 
{
    // Required
    fn validate_byte_slice(bytes: &[u8]) -> Result<(), ZeroVecError>;

    // Some automatically provided methods elided
}

pub unsafe trait VarULE: 'static {
    fn validate_byte_slice(_bytes: &[u8]) -> Result<(), ZeroVecError>;
    unsafe fn from_byte_slice_unchecked(bytes: &[u8]) -> &Self;

    // Some automatically provided methods elided
}

use std::str::FromStr;
use icu_calendar::Date;
use icu_datetime::{options::length, DateFormatter};
use icu_locid::Locale;

fn main() {
    let locale = Locale::from_str("en-u-ca-japanese").unwrap();
    let formatter = DateFormatter::try_new_with_length(&locale.into(), length::Date::Full).unwrap();
    let date = Date::try_new_iso_date(2020, 5, 30).unwrap().to_any();
    dbg!(formatter.format_to_string(&date).unwrap());
}

#[cfg_attr(feature = "serde", derive(serde::Deserialize))]
pub struct JapaneseErasV1<'data> {
    /// A map from era start dates to their era codes
    #[cfg_attr(feature = "serde", serde(borrow))]
    pub dates_to_eras: ZeroVec<'data, (EraStartDate, TinyStr16)>,
}

pub struct EraStartDate {
    /// The year the era started in
    pub year: i32,
    /// The month the era started in
    pub month: u8,
    /// The day the era started in
    pub day: u8,
}

pub type TinyStr16 = TinyAsciiStr<16>;

#[repr(transparent)]
#[derive(PartialEq, Eq, Ord, PartialOrd, Copy, Clone, Hash)]
pub struct TinyAsciiStr<const N: usize> {
    bytes: [AsciiByte; N],
}

//! # Examples
//!
//! ```
//! use zerovec::ZeroVec;
//!
//! // ZeroVec of tuples!
//! let zerovec: ZeroVec<(u32, char)> = [(1, 'a'), (1234901, '啊'), (100, 'अ')]
//!     .iter()
//!     .copied()
//!     .collect();
//!
//! assert_eq!(zerovec.get(1), Some((1234901, '啊')));
//! ```

macro_rules! tuple_ule {
    ($name:ident, $len:literal, [ $($t:ident $i:tt),+ ]) => {
        #[doc = concat!("ULE type for tuples with ", $len, " elements.")]
        #[repr(packed)] // 注意这里
        #[allow(clippy::exhaustive_structs)]
        pub struct $name<$($t),+>($(pub $t),+);

// #[derive(Debug)]
#[repr(packed)]
pub struct EraStartDate {
    /// The year the era started in
    pub year: i32,
    /// The month the era started in
    pub month: u8,
    /// The day the era started in
    pub day: u8,
}

// #[repr(C)]
#[repr(packed)]
// #[repr(packed,C)]
pub struct TestTuple(EraStartDate, [AsciiByte; 16]);

#[repr(C,packed)]

-   impl<'a> Iterator for ResultIterator<'a> {
-       type Item = Row<'a>;
-       fn next(&mut self) -> Option<<Self as Iterator>::Item> {
+   impl LendingIterator for ResultIterator<'_> {
+       type Item<'a> = Row<'a> where Self: 'a;
+
+       fn next(&mut self) -> Option<<Self as LendingIterator>::Item<'_>> {
            unsafe {
                match cass_iterator_next(self.0) {
                    cass_false => None,
                    cass_true => Some(self.get_row()),
                }
            }
        }

-   impl<'a> ResultIterator<'a> {
-       /// Gets the next row in the result set
-       pub fn get_row(&mut self) -> Row<'a> {
+   impl ResultIterator<'_> {
+       /// Gets the current row in the result set
+       pub fn get_row(&self) -> Row {
            unsafe { Row::build(cass_iterator_get_row(self.0)) }
    }

pub trait LendingIterator {
    
    type Item<'a>
    where
        Self: 'a;
}

-   pub struct Row<'a>(*const _Row, PhantomData<&'a CassResult>);
+   pub struct Row<'a>(*const _Row, PhantomData<&'a _Row>);

const CassRow* cass_iterator_get_row(const CassIterator* iterator) {
  if (iterator->type() != CASS_ITERATOR_TYPE_RESULT) {
    return NULL;
  }
  return CassRow::to(static_cast<const ResultIterator*>(iterator->from())->row());
}


class ResultIterator : public Iterator {
  ResultIterator(const ResultResponse* result)
      , result_(result)
      , row_(result) {
      }  

  const Row* row() const {
    assert(index_ >= 0 && index_ < result_->row_count());
    if (index_ > 0) {
      return &row_;
    } else {
      return &result_->first_row();
    }
  }
  const ResultResponse* result_;
  Row row_;         // < ----- 注意这里
};

-   impl<'a> Iterator for ResultIterator<'a> {
-       type Item = Row<'a>;
-       fn next(&mut self) -> Option<<Self as Iterator>::Item> {
+   impl LendingIterator for ResultIterator<'_> {
+       type Item<'a> = Row<'a> where Self: 'a;
+
+       fn next(&mut self) -> Option<<Self as LendingIterator>::Item<'_>> {

-   pub struct Row<'a>(*const _Row, PhantomData<&'a CassResult>);
+   pub struct Row<'a>(*const _Row, PhantomData<&'a _Row>);

let mut tmp_row = None;
let result = function.get_result();
{
    for row in result.iter() {
        if condition.satisfied():
            tmp_row = Some(row)
            break;
    }
}

println!("here will cause problem {:?}", tmp_row);

let result = ResultSet::new();
let mut taget_row = result.iter().get_row();
for row in result.iter() {
    taget_row = row;
    // println!("ks name = {}", col);
    break;
}

taget_row.visit();
println!("target iterator is {:?}", taget_row);
let result = ResultSet::new();