rustsec_refs_imported() could possibly panic on short or malformed rustsec.org URLs

[gkamathe]

Summary

I see hardcoded byte-range slice [31..48] usage in the function rustsec_refs_imported()

rustsec/src/osv/advisory.rs

    /// Try to extract RustSec alias id from OSV advisory metadata
    pub fn rustsec_refs_imported(&self) -> Vec<Id> {
        let mut refs: Vec<Id> = self
            .references
            .iter()
            .filter(|r| {
                r.url
                    .as_str()
                    .starts_with("https://rustsec.org/advisories/")
            })
            .map(|r| Id::from_str(&r.url.as_str()[31..48]).expect("Invalid rustsec url"))
            .collect();
        refs.sort();
        refs.dedup();
        refs
    }

It seems that the prefix "https://rustsec.org/advisories/" is 31 bytes.
The slice [31..48] assumes 17 more bytes for the following (the length of RUSTSEC-YYYY-NNNN) ?
URLs that match the prefix but are shorter than 48 bytes cause an out-of-bounds panic.
Also, URLs that are long enough but don't contain a valid advisory ID cause a panic from expect.

Reproduce

Create a reference URL that starts with https://rustsec.org/advisories/ but is shorter than 48 bytes, then call rustsec_refs_imported()