Require explicit acknowledgement for risky Rust call analysis

README.md

@@ -57,6 +57,10 @@ This command will recursively scan the specified directory for any supported pac
 
 OSV-Scanner has the option of using call analysis to determine if a vulnerable function is actually being used in the project, resulting in fewer false positives, and actionable alerts.
 
+> [!WARNING]
+> Rust call analysis can execute build scripts (`build.rs`) during compilation and may run arbitrary code from the scanned project.
+> Use it only for trusted projects and pass `--allow-risky-rust-call-analysis` when enabling `--call-analysis=rust`.
+
 OSV-Scanner can also detect vendored C/C++ code for vulnerability scanning. See [here](https://google.github.io/osv-scanner/usage/#cc-scanning) for details.
 
 #### Supported Lockfiles

cmd/osv-scanner/internal/helper/flags.go

@@ -165,6 +165,10 @@ func BuildCommonScanFlags(defaultExtractors []string) []cli.Flag {
 			Name:  "call-analysis",
 			Usage: "Enable call analysis for specific languages (e.g. --call-analysis=go). Supported: go, rust (*). (*) Will run build scripts.",
 		},
+		&cli.BoolFlag{
+			Name:  "allow-risky-rust-call-analysis",
+			Usage: "acknowledge that rust call analysis may execute untrusted build scripts (build.rs)",
+		},
 		&cli.StringSliceFlag{
 			Name:  "no-call-analysis",
 			Usage: "disables call graph analysis",

cmd/osv-scanner/scan/source/command.go

@@ -126,6 +126,10 @@ func action(_ context.Context, cmd *cli.Command, stdout, stderr io.Writer, clien
 	}
 
 	scannerAction := helper.GetCommonScannerActions(cmd, scanLicensesAllowlist)
+	// Rust call analysis builds the scanned project, so require explicit trust acknowledgement.
+	if scannerAction.CallAnalysisStates["rust"] && !cmd.Bool("allow-risky-rust-call-analysis") {
+		return errors.New("refusing to run rust call analysis without explicit acknowledgement: pass --allow-risky-rust-call-analysis if you trust this project")
+	}
 
 	scannerAction.LockfilePaths = cmd.StringSlice("lockfile")
 	//nolint:staticcheck // ignore our own deprecated field