Skip to content

v0.2.1 — Hardening

Choose a tag to compare

View all tags
@github-actions github-actions released this 01 Jun 18:20
· 5 commits to main since this release
v0.2.1
7d185aa
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Install

cargo install logdive logdive-api

Or grab a prebuilt binary for Linux x86_64 / macOS arm64 from the assets below.

Security tests (H1)

10 new tests in crates/core/tests/security.rs:

  • SQL injection via field name — tokenizer rejects ', ;, Unicode lookalikes (U+2019) before SQL is generated
  • SQL injection via value — bound parameters prevent DROP TABLE and 1=1 tautology payloads
  • LIKE wildcard escaping — _ and \ in contains queries match literally, not as SQL wildcards
  • Resource exhaustion — 1 000-disjunct OR query completes without stack overflow; 10 MB raw line ingested without panic or OOM

Functional tests (H2)

28 new tests across 7 suites:

  • Property-based (proptest): arbitrary input never panics; valid equality queries produce correct ASTs; OR disjunct count matches input
  • Cross-format dedup: same raw line ingested twice → one row; JSON vs. logfmt with identical logical content → two distinct rows
  • Concurrent ingest: two logdive ingest processes on the same DB produce no corruption and dedup is respected
  • Parser edge cases: UTF-8 BOM rejected; deeply nested object in known field preserved; whitespace in field values preserved verbatim
  • Time-range: space-separator datetime accepted; boundary row at cutoff included (>=); far-future timestamp returns empty; +00:00 equivalent to Z
  • Follow mode: file deleted after open returns Ok([]), not error; burst of appended lines read completely in one call
  • API integration: limit > match count returns all matches; contains operator; since time-range; CORS preflight returns access-control-allow-origin: *; raw field present in every response entry
  • Prune boundary: entry at cutoff not deleted; idempotent second prune deletes nothing

Supply-chain hardening (H3)

  • Cargo.lock tracked for reproducible builds and deterministic audit scans
  • deny.toml: license allowlist (MIT / Apache-2.0 / BSD-2-Clause / BSD-3-Clause / ISC / CC0-1.0 / Unlicense / Zlib / BSL-1.0 and variants), RustSec advisory checks (vulnerability = deny, unsound = deny), crates.io-only source policy
  • scripts/audit.sh: cargo-audit runner
  • scripts/sbom.sh: CycloneDX JSON SBOM via cargo-cyclonedx
  • .github/workflows/audit.yml: daily advisory scan + cargo deny check (informational)
  • .github/workflows/ci.yml: permissions: contents: read added; cargo deny check added to lint job (merge-blocking)

Performance fixes

  • entry_to_json_string in logdive-api now uses serde_json::to_string(&entry) directly — eliminates an O(fields) heap allocation per HTTP response row
  • LogEntry::with_tag signature changed from Option to Option<&str> — eliminates a String clone per ingested entry
Assets 4
Loading