Do you use relative toolchain paths with rustup? Let us know!

Hey, a rustup maintainer here. We've merged a change that alters how rust-toolchain{.toml} files handle toolchain specifications.

In the current release of rustup a toolchain in one of those files can be a named version (1.69), or a custom toolchain (my-stage-2), or a (possibly dated) channel (nightly), or, and this is the point to discuss, the path to the root directory of a toolchain anywhere in the filesystem.

This last point is a problem - unlike the other ways of naming a toolchain, it permits arbitrary code execution : a toolchain file can specify say ./exploit as the path to the toolchain, and then running cargo run in that directory will execute ./exploit/bin/cargo[.exe].

So, the plan is for the next release of rustup to no longer accept those toolchain files. Absolute paths in a toolchain file are still accepted.

If you are someone actively using such relative-path toolchains, please contact us (Discord / Github issues).

The path based support was added to help with fully automated and reproducible setups that are meant to not muck around with the global state of the regular rustup toolchains, but instead manage their own toolchains somewhere else - and we've verified that that use case does not require relative paths.

However walking back any previously released feature has some risk, so I just want to find out if there are people who have started using this unintentional feature.

Thanks!