[Rd] unsafe parsing of DESCRIPTION Authors maybe from R

[Levi Waldron]

This issue arose during an AI-assisted security review of core Bioconductor
packages, that an attacker could execute arbitrary code on any system that
calls `utils:::.read_authors_at_R_field()` or other tools for parsing a
DESCRIPTION file,  regardless of whether it installs, builds, or checks the
package. I put some details and a reprex at
https://github.com/lwaldron/nothing/tree/check-vulnerability. Let me know
if you'd prefer I take the github page down.

This seems worse than the inherent .onLoad(), tests/, etc vulnerabilities,
because it can be exploited in environments not intended to install or
check packages or run their code, like the CRAN incoming package queue
which does seem to parse the DESCRIPTION file.

-Levi

-- 

Levi Waldron

Professor and Chair

Department of Epidemiology and Biostatistics

CUNY Graduate School of Public Health and Health Policy

Institute for Implementation Science in Population Health

55 W 125th St, New York NY 10035

https://waldronlab.io

Join the microbiome Virtual International Forum: https://microbiome-vif.org

	[[alternative HTML version deleted]]