Security
At the moment, rust-analyzer assumes that all code is trusted. Here is a non-exhaustive list of ways to make rust-analyzer execute arbitrary code:
- 
proc macros and build scripts are executed by default 
- 
.cargo/configcan overriderustcwith an arbitrary executable
- 
rust-toolchain.tomlcan overriderustcwith an arbitrary executable
- 
VS Code plugin reads configuration from project directory, and that can be used to override paths to various executables, like rustfmtorrust-analyzeritself.
- 
rust-analyzer’s syntax trees library uses a lot of unsafeand hasn’t been properly audited for memory safety.