Skip to content

fix(deny): ignore quick-xml 0.39.4 DoS advisories (#169)#171

Merged
hellno merged 1 commit into
mainfrom
hellno/issue-169-review
Jul 2, 2026
Merged

fix(deny): ignore quick-xml 0.39.4 DoS advisories (#169)#171
hellno merged 1 commit into
mainfrom
hellno/issue-169-review

Conversation

@hellno

@hellno hellno commented Jul 2, 2026

Copy link
Copy Markdown
Owner

What

The nightly cargo deny check advisories scan (issue #169) went red on two new RustSec advisories against quick-xml 0.39.4:

ID Class Summary
RUSTSEC-2026-0194 CPU-exhaustion DoS Quadratic run time checking a start tag for duplicate attribute names
RUSTSEC-2026-0195 Memory-exhaustion DoS Unbounded namespace-declaration allocation in NsReader

Both fixed in quick-xml >= 0.41.0. Added a justified ignore for both in deny.toml.

Why ignore instead of bump

The bump is not selectable in-tree:

zbus_xml 5.1.1 requires quick-xml ^0.39  →  0.41.0 rejected

quick-xml 0.39.4 has exactly one consumer, the gpui Linux AT-SPI accessibility stack:

deckard-app → gpui_platform → gpui_linux → accesskit_unix
            → accesskit_atspi_common → atspi-common → zbus-lockstep → zbus_xml → quick-xml

That chain lives inside the pinned gpui git stack and moves only via just bump-gpui (which itself needs upstream accesskit/atspi/zbus to advance to quick-xml ≥ 0.41).

Risk

  • Linux-target-only — cargo tree on the macOS host resolves 0 copies of quick-xml 0.39.4; it never compiles into the shipped macOS binary.
  • Liveness only — CPU/memory exhaustion parsing D-Bus introspection XML; not a custody or confidentiality risk.
  • Same shape as the existing hickory / gtk transitive DoS ignore entries; both carry a re-evaluate on just bump-gpui note.

Verification

$ cargo deny check advisories
advisories ok
$ cargo deny check
advisories ok, bans ok, licenses ok, sources ok

Config-only change (deny.toml, +10 lines) — no Rust code touched.

Closes #169

@hellno
fix(deny): ignore quick-xml 0.39.4 DoS advisories (#169)
1480121 
The nightly `cargo deny check advisories` scan went red on two new RustSec
advisories against quick-xml 0.39.4:

  - RUSTSEC-2026-0194 — quadratic run time checking a start tag for duplicate
    attribute names (CPU-exhaustion DoS)
  - RUSTSEC-2026-0195 — unbounded namespace-declaration allocation in NsReader
    (memory-exhaustion DoS)

Both are fixed in quick-xml >= 0.41.0, but the bump is not selectable in-tree:
zbus_xml 5.1.1 pins `quick-xml ^0.39`, and its only consumer is gpui's Linux
AT-SPI accessibility stack (gpui_linux -> accesskit_unix -> atspi ->
zbus-lockstep -> zbus_xml). That chain lives inside the pinned gpui git stack
and moves only via `just bump-gpui`, which in turn needs upstream
accesskit/atspi/zbus to advance to quick-xml >= 0.41.

The crate is Linux-target-only — `cargo tree` on the macOS host resolves zero
copies, so it never compiles into the shipped macOS binary — and both
advisories are liveness (CPU/memory exhaustion) rather than a custody or
confidentiality risk. Same shape as the existing hickory/gtk transitive DoS
entries, so both IDs get a justified `ignore` with a re-evaluate-on-bump-gpui
note. Advisories scan is green again locally.

Closes #169
@hellno
hellno merged commit 0e2b5c0 into main Jul 2, 2026
9 of 10 checks passed
@hellno
hellno deleted the hellno/issue-169-review branch July 2, 2026 15:10
@hellno hellno mentioned this pull request Jul 2, 2026
Merged
hellno added a commit that referenced this pull request Jul 2, 2026
@hellno
docs(deny): correct the quick-xml ignore trigger (zbus_xml release, n…
bf795a2 
…ot bump-gpui) (#175)

The two RUSTSEC-2026-0194/-0195 ignore entries added in #171 said "re-evaluate on
just bump-gpui". That trigger is wrong. The advisories clear when a new `zbus_xml`
release carries quick-xml 0.41 — independent of gpui:

  - The fix is already merged on z-galaxy/zbus main (commit c38bb96, 2026-06-29,
    a Cargo.toml-only bump) but unreleased; latest published zbus_xml 5.1.1 still
    pins quick-xml ^0.39.
  - Every consumer in our tree accepts `zbus_xml ^5.0.2`, so once a 5.x carrying
    quick-xml 0.41 ships, `cargo update -p zbus_xml` cascades quick-xml -> 0.41.0
    and these entries drop — no gpui bump, no accesskit/atspi/zed change.
  - Caveat noted: a zbus_xml 6.0 (rather than 5.x) would break the ^5.0.2 chain
    and widen the fix to zbus-lockstep/atspi/accesskit.

Comment-only change to deny.toml; `cargo deny check advisories` stays green.
This was referenced Jul 2, 2026
Merged
Merged
hellno added a commit that referenced this pull request Jul 2, 2026
@hellno
docs(deny): trim the quick-xml ignore comment to match house style
fd58e36 
The quick-xml ignore block landed in #171/#175 was ~12 comment lines with heavy
ALL-CAPS emphasis and reason strings that duplicated the comment — inconsistent
with the file's other ignore groups (hickory/gtk are 3-4 tight lines with concise
one-line reasons). Tighten to the same style; no facts lost (trigger = a zbus_xml
5.x release on quick-xml 0.41, merged-but-unreleased upstream, no gpui bump, 6.0
caveat all retained). Comment-only; `cargo deny check advisories` stays green.
hellno added a commit that referenced this pull request Jul 2, 2026
@hellno
docs(deny): tighten + correct the quick-xml ignore note (#176)
5b87f2f 
* docs(deny): trim the quick-xml ignore comment to match house style

The quick-xml ignore block landed in #171/#175 was ~12 comment lines with heavy
ALL-CAPS emphasis and reason strings that duplicated the comment — inconsistent
with the file's other ignore groups (hickory/gtk are 3-4 tight lines with concise
one-line reasons). Tighten to the same style; no facts lost (trigger = a zbus_xml
5.x release on quick-xml 0.41, merged-but-unreleased upstream, no gpui bump, 6.0
caveat all retained). Comment-only; `cargo deny check advisories` stays green.

* docs(deny): correct the quick-xml note — two sources, narrow don't drop

A parallel investigation (+ the upstream nudge z-galaxy/zbus#1837) surfaced that
these advisories fire on TWO sub-0.41 quick-xml copies, not one:
  - 0.39.4 — runtime, via the gpui Linux AT-SPI stack (fixed by a zbus_xml 5.x)
  - 0.30.0 — a *build* dep of xcb 1.7.0 (X11 protocol XML; trusted input, no
    runtime surface, and no released xcb uses quick-xml >=0.41)

The advisories have no lower bound, so both match; cargo-deny just collapses the
report to the 0.39.4 node. So the earlier "drop the two ignores once zbus_xml
ships" was over-optimistic — after `cargo update -p zbus_xml` the xcb 0.30.0
build-dep still fires. Correct the note to NARROW (not delete) the entries to the
xcb residual, and reference the upstream release nudge.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Daily cargo-deny advisory scan is failing

1 participant

@hellno