From 1480121ad8737cb02059aba3f7ce00fca4b1af07 Mon Sep 17 00:00:00 2001 From: hellno Date: Thu, 2 Jul 2026 16:49:39 +0200 Subject: [PATCH] fix(deny): ignore quick-xml 0.39.4 DoS advisories (#169) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The nightly `cargo deny check advisories` scan went red on two new RustSec advisories against quick-xml 0.39.4: - RUSTSEC-2026-0194 — quadratic run time checking a start tag for duplicate attribute names (CPU-exhaustion DoS) - RUSTSEC-2026-0195 — unbounded namespace-declaration allocation in NsReader (memory-exhaustion DoS) Both are fixed in quick-xml >= 0.41.0, but the bump is not selectable in-tree: zbus_xml 5.1.1 pins `quick-xml ^0.39`, and its only consumer is gpui's Linux AT-SPI accessibility stack (gpui_linux -> accesskit_unix -> atspi -> zbus-lockstep -> zbus_xml). That chain lives inside the pinned gpui git stack and moves only via `just bump-gpui`, which in turn needs upstream accesskit/atspi/zbus to advance to quick-xml >= 0.41. The crate is Linux-target-only — `cargo tree` on the macOS host resolves zero copies, so it never compiles into the shipped macOS binary — and both advisories are liveness (CPU/memory exhaustion) rather than a custody or confidentiality risk. Same shape as the existing hickory/gtk transitive DoS entries, so both IDs get a justified `ignore` with a re-evaluate-on-bump-gpui note. Advisories scan is green again locally. Closes #169 --- deny.toml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/deny.toml b/deny.toml index 58f0670..bea43f0 100644 --- a/deny.toml +++ b/deny.toml @@ -59,6 +59,16 @@ ignore = [ { id = "RUSTSEC-2024-0418", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, { id = "RUSTSEC-2024-0419", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, { id = "RUSTSEC-2024-0420", reason = "gtk-rs GTK3 binding unmaintained; optional `tray` feature only (libappindicator→gtk3), no GTK4 tray path yet" }, + # ── quick-xml 0.39.4 — two DoS advisories in the D-Bus introspection-XML parser. LINUX-ONLY and + # transitive: the ONLY consumer is gpui's Linux AT-SPI accessibility stack + # (gpui_linux → accesskit_unix → atspi → zbus-lockstep → zbus_xml → quick-xml); it does not + # compile into the shipped macOS binary (`cargo tree` on the mac host resolves 0 copies). + # Liveness (CPU / memory exhaustion), not a custody or confidentiality risk. No in-tree fix: + # `zbus_xml 5.1.1` pins `quick-xml ^0.39`, so the fixed `>=0.41.0` is unselectable until the + # pinned gpui git stack advances accesskit/atspi/zbus — which moves only via `just bump-gpui`. + # Re-evaluate (and drop) on the next gpui bump. + { id = "RUSTSEC-2026-0194", reason = "quick-xml quadratic duplicate-attribute-name DoS; Linux-only, transitive via gpui AT-SPI (zbus_xml pins ^0.39, not in the macOS binary); liveness-only; re-evaluate on just bump-gpui" }, + { id = "RUSTSEC-2026-0195", reason = "quick-xml unbounded namespace-declaration allocation memory-exhaustion DoS; Linux-only, transitive via gpui AT-SPI (zbus_xml pins ^0.39, not in the macOS binary); liveness-only; re-evaluate on just bump-gpui" }, ] [licenses]