sasheldon.com

How I Broke Rust's Package Manager for All Windows Users

Last weekend I was playing around with a way to represent null-terminated UTF8 strings in Rust. Rather than just toying with it forever, I decided to clean up a minimal version and publish it to crates.io. Creating the crate went smoothly, exactly the same as the 11 prior crates I’ve published. I closed up my laptop and called it a day.

Well, everything only seemed the same until an hour later when I got this tweet:

The impact

The crate I had just published was named nul, after the null terminator character which is abbreviated as NUL. I hopped onto Rust’s IRC channel to figure out what I had done, and the friendly Rust devs informed me that they were going to delete nul from crates.io.

While trying to catch up at this point, I saw that there was an issue filed on my repo. And an issue filed on cargo. And a reddit thread. Whoops.

Whenever any users on Windows attempted to download new crates or update their dependencies, they were greeted with this error:

Updating registry https://github.com/rust-lang/crates.io-index
error: [20/-1] Cannot checkout to invalid path '3/n/nul'

As kmc described the status of cargo on Windows:

But why?

Turns out that “NUL” (including “nul”) is a reserved filename on Windows. NUL is the Windows equivalent of Unix’s /dev/null, but instead of existing at a specific directory you can write to NUL in any directory, and even with any extension!

That might sound surprising, but Raymond Chen has an illuminating explanation:

Because DOS 1.0 didn’t have subdirectories. There was only one directory, which today we would call the root directory…

And so, since these DOS 1.0 days, tons of batch files exist on Windows redirecting with >NUL, and the reserved filenames remain.

The aftermath

Once my nul crate was deleted, Windows users were back in business. The Rust team quickly moved to prevent this issue from happening again by adding “NUL” and Windows’ 21 other reserved filenames to the list of reserved crate names. Guess I won’t get to publish that aux crate now 😉

Apologies to Carol Nichols and any other Rust devs whose weekends I interrupted, thanks for your quick action!

Although, I mean, like withoutboats said: