Code review of the plutonium crate // Lib.rs

RUSTSEC-2020-0011 (notice) on 2020-04-23: Library exclusively intended to obfuscate code.

This crate allows you to write safe functions with unsafe bodies without the unsafe keyword.

The value this adds is questionable, and hides unsafe usages from naive analysis.

GHSA-gfg9-x6px-r7gr

This review is from Crev, a distributed system for code reviews. To add your review, set up cargo-crev.

The current version of plutonium is 0.5.2.

0.2.2 (older version) Rating: Negative Thoroughness: None Understanding: None

by kornelski on 2020-05-13

Don't use it in production.

Crates in the crates.io registry are tarball snapshots uploaded by crates' publishers. The registry is not using crates' git repositories. There is absolutely no guarantee that the repository URL declared by the crate belongs to the crate, or that the code in the repository is the code inside the published tarball.

To review the actual code of the crate, it's best to use cargo crev open plutonium. Alternatively, you can download the tarball of plutonium v0.5.2 or view the source online.