Auditing Rust Crates Effectively
Lydia Zoghbi, David Thien, Ranjit Jhala, Deian Stefan, and Caleb Stanford

TL;DR
Cargo Scan is an interactive Rust analysis tool that efficiently identifies potentially dangerous code effects in third-party crates, significantly reducing manual auditing effort by leveraging Rust's type system and side-effects analysis.
Contribution
We present Cargo Scan, the first Rust-specific tool that models effects and performs side-effects analysis to aid developers in auditing third-party dependencies efficiently.
Findings
Cargo Scan reduces auditing effort to 0.2% of lines for hyper crate.
Automatically classifies ~3.5K of top 10K crates as safe.
Most dangerous effects are concentrated in about 3% of crates.
Abstract
We introduce Cargo Scan, the first interactive program analysis tool designed to help developers audit third-party Rust code. Real systems written in Rust rely on thousands of transitive dependencies. These dependencies are as dangerous in Rust as they are in other languages (e.g., C or JavaScript) -- and auditing these dependencies today means manually inspecting every line of code. Unlike for most industrial languages, though, we can take advantage of Rust's type and module system to minimize the amount of code that developers need to inspect to the code that is potentially dangerous. Cargo Scan models such potentially dangerous code as effects and performs a side-effects analysis, tailored to Rust, to identify effects and track them across crate and module boundaries. In most cases (69.2%) developers can inspect flagged effects and decide whether the code is potentially dangerous…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSoftware Testing and Debugging Techniques · Software Engineering Research · Web Application Security Vulnerabilities
