search

gentoo / cargo-ebuild

[MIRROR] cargo extension that can generate ebuilds using the in-tree eclasses
https://gitweb.gentoo.org/proj/cargo-ebuild.git
Apache License 2.0
33 stars 10 forks source link

Implement audit functionality using rustsec #15

Closed leonardohn closed 3 years ago

leonardohn commented 3 years ago

These commits removes the redundant cargo-lock usage (closes #7) and implements crate auditing through rustsec library (closes #2). An example of output using base64_vuln crate from rustsec tests:

Error: Found 1 vulnerability:

Crate:    base64
Version:  0.5.1
Title:    Integer overflow leads to heap-based buffer overflow in encode_config_buf
Date:     2017-05-03
ID:       RUSTSEC-2017-0004
URL:      https://rustsec.org/advisories/RUSTSEC-2017-0004
Solution: Upgrade to >=0.5.2

Please fix the issues or use "--noaudit" flag.
gyakovlev commented 3 years ago

thanks, that's exiting. I've merged templating PR, could you please rebase?

leonardohn commented 3 years ago

Done. Anything else?

gyakovlev commented 3 years ago

I'll get back once tested, but I don't have anything else in mind if it works.

gyakovlev commented 3 years ago 
/tmp/alacritty-0.4.1/alacritty $ /tmp/cargo-ebuild ebuild
Error: Found 5 vulnerabilities:

Crate:    arc-swap
Version:  0.4.4
Title:    Dangling reference in `access::Map` with Constant
Date:     2020-12-10
ID:       RUSTSEC-2020-0091
URL:      https://rustsec.org/advisories/RUSTSEC-2020-0091
Solution: Upgrade to >=0.4.8, <1.0.0-0 or >=1.1.0

Crate:    ordered-float
Version:  1.0.2
Title:    ordered_float:NotNan may contain NaN after panic in assignment operators
Date:     2020-12-06
ID:       RUSTSEC-2020-0082
URL:      https://rustsec.org/advisories/RUSTSEC-2020-0082
Solution: Upgrade to ^1.1.1 or >=2.0.1

Crate:    smallvec
Version:  0.6.13
Title:    Buffer overflow in SmallVec::insert_many
Date:     2021-01-08
ID:       RUSTSEC-2021-0003
URL:      https://rustsec.org/advisories/RUSTSEC-2021-0003
Solution: Upgrade to >=0.6.14, <1.0.0 or >=1.6.1

Crate:    smallvec
Version:  1.1.0
Title:    Buffer overflow in SmallVec::insert_many
Date:     2021-01-08
ID:       RUSTSEC-2021-0003
URL:      https://rustsec.org/advisories/RUSTSEC-2021-0003
Solution: Upgrade to >=0.6.14, <1.0.0 or >=1.6.1

Crate:    xcb
Version:  0.9.0
Title:    Multiple soundness issues
Date:     2021-02-04
ID:       RUSTSEC-2021-0019
URL:      https://rustsec.org/advisories/RUSTSEC-2021-0019
Solution: No solution available

Please fix the issues or use "--noaudit" flag.

nice!