colored-rs / colored

(Rust) Coloring terminal so simple you already know how to do it !
Mozilla Public License 2.0
1.73k stars 83 forks source link

atty has a cve and could be replaced by is-terminal #127

Closed nstinus closed 1 year ago

nstinus commented 1 year ago
warning[unsound]: Potential unaligned read
  ┌─ Cargo.lock:4:1
  │
4 │ atty 0.2.14 registry+https://github.com/rust-lang/crates.io-index
  │ ----------------------------------------------------------------- unsound advisory detected
  │
  = ID: RUSTSEC-2021-0145
  = Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0145
  = On windows, `atty` dereferences a potentially unaligned pointer.

    In practice however, the pointer won't be unaligned unless a custom global allocator is used.

    In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.

    # atty is Unmaintained

    A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.

    Last release of `atty` was almost 3 years ago.

    ## Possible Alternative(s)

    The below list has not been vetted in any way and may or may not contain alternatives;

     - [is-terminal](https://crates.io/crates/is-terminal)
     - std::io::IsTerminal *nightly-only experimental*
  = Announcement: https://github.com/softprops/atty/issues/50
  = Solution: No safe upgrade is available!
  = atty v0.2.14
    └── colored v2.0.0
nstinus commented 1 year ago

Already fixed by https://github.com/mackwic/colored/pull/122