Fix stdweb audit advisotry RUSTSEC-2020-0056

[notmandatory]

% cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 405 security advisories (from /home/steve/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (238 crate dependencies)
Crate:         stdweb
Version:       0.4.20
Warning:       unmaintained
Title:         stdweb is unmaintained
Date:          2020-05-04
ID:            RUSTSEC-2020-0056
URL:           https://rustsec.org/advisories/RUSTSEC-2020-0056
Dependency tree: 
stdweb 0.4.20
└── time 0.2.27
    ├── cookie_store 0.12.0
    │   └── ureq 1.5.5
    └── cookie 0.14.4
        ├── ureq 1.5.5
        └── cookie_store 0.12.0

warning: 1 allowed warning found

[rajarshimaitra]

I think I found the bottom of this hole.. The stdweb lib was a complex JS to Rust link library and I have no clue why they needed it in time. And now its saying unmaintained so even a more higher vulnerability.

Recent version of time removes stdweb from its dep. And recent ureq ~2.2.0 updates the change.

The problem is occurring from ureq 1.5.5 which uses a lower version of time which still has stdweb , and it's only requirement of bitcoind.

bdk-cli/Cargo.lock

Lines 266 to 280 in 8d14cf5

	[[package]]
	name = "bitcoind"
	version = "0.20.0"
	source = "registry+https://github.com/rust-lang/crates.io-index"
	checksum = "65ddc41af9556a341c909bc71de33e16da52bf5f8dbda6b7a402054c60bdb722"
	dependencies = [
	"bitcoin_hashes 0.10.0",
	"bitcoincore-rpc",
	"flate2",
	"home",
	"log",
	"tar",
	"tempfile",
	"ureq 1.5.5",
	]

And Ricardo pinned this version for the MSRV constraint.

https://github.com/RCasatta/bitcoind/blob/31e88fdb011e37ebec08c710ad994d62d46b42b7/Cargo.toml#L22

So the easiest way to fix is remove the pin in bitcoind and let it use the latest ureq.

cc @RCasatta

UPDATE: The same situation is there for BDK too..

[RCasatta]

The plan I have in mind is:

• rust-bitcoincore-rpc 0.15 with bitcoin 0.28 is released Release v0.15.0 rust-bitcoin/rust-bitcoincore-rpc#221
• merge Add feature for Bitcoin Core 23.0 rust-bitcoin/bitcoind#62 and use updated rust-bitcoincore-rpc and consequently bitcoin 0.28.0 rust-bitcoin/bitcoind#60, release bitcoind 0.26.0
• remove pinning and increase MSRV to x.x.x (TBD) release bitcoind 0.27.0

[notmandatory]

On the MSRV question BDK is bumping up to 1.56.0.

• Bump MSRV to 1.56 bdk#596.

Also the focus for the next bdk release 0.19.0 is TP support so also updating bitcoin to 0.28 along with other dependencies doing the same like rust-bitcoincore-rpc. Once BDK 0.19.0 is released the high priority for bdk-cli should be to do the corresponding updates.

[notmandatory]

I think this will be fixed by #99 so I assigned it to you @rajarshimaitra to confirm. Thanks!

[rajarshimaitra]

It seems its still there with #99

$ cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 417 security advisories (from /home/raj/.cargo/advisory-db)
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (268 crate dependencies)
Crate:         stdweb
Version:       0.4.20
Warning:       unmaintained
Title:         stdweb is unmaintained
Date:          2020-05-04
ID:            RUSTSEC-2020-0056
URL:           https://rustsec.org/advisories/RUSTSEC-2020-0056
Dependency tree: 
stdweb 0.4.20
└── time 0.2.27
    ├── cookie_store 0.12.0
    │   └── ureq 1.5.5
    └── cookie 0.14.4
        ├── ureq 1.5.5
        └── cookie_store 0.12.0

warning: 1 allowed warning found