Vulnerability in tungstenite 0.19.0

[thibault-martinez]

Hello,

The vulnerability https://rustsec.org/advisories/RUSTSEC-2023-0065 has been issued and the crate is present in the dependency tree of your latest released version, making CIs to fail.

You have updated tungstenite to ^0.20 here https://github.com/najamelan/ws_stream_tungstenite/commit/cf2ebbd4782e10547a15f2ce4c08d683bd0a6b54 but haven't released a version since.

Would you be so kind as to release a patch please 🙏🏻 ?

Thanks in advance.

[najamelan]

Thanks for reporting. Yeah, I didn't see this one yet. I'm working on an update but 0.20 changed how tungstenite returns errors on messages that overflow the send buffer. I need to implement a good solution to that. Unfortunately im working full time and very busy, but will try to do it tomorrow after work.

The version above has failing CI because of that issue.

[najamelan]

I made progress on this. The issue is that before 0.20, there was no outgoing buffer in tungstenite. It would just send over the wire the message you give it immediately regardless of the size. With 0.20 tungstenite now returns an error if the message size exceeds the tungstenite configuration max_send_buffer_len.

I did some testing to make sure I understand exactly how it works. As we are implementing AsyncWrite, we don't want to deal with this error. We should just not send in more data then the websocket can handle. Especially because it's just a buffer of u8 that we take in and we choose how much we consume. Otherwise people could shoot themselves in the foot easily. std::io::Error that we'd have to return is generally fatal on AsyncWrite.

Thus I solved this for poll_write by checking the size of the buffer and not sending any more. What is left to do:

• solve the problem for poll_write_vectored
• test
• document

I will try to wrap it up tomorrow night and release a new version. For poll_write_vectored it's a bit of a thorny problem, I hope I find a solution, if not the method documentation will just inform that if you send in too much data it will break the connection.

[najamelan]

I came of work way too late today, so I didn't quite finish. However implemented a solution for poll_write_vectored. I opened a pull request if anyone wants to review:

https://github.com/najamelan/ws_stream_tungstenite/pull/14

To be done tomorrow:

• debug why backpressure_send_text integration test hangs
• test new buffer size situation
• docs
• release

[najamelan]

Version 0.11 has been released to crates.io which uses tungstenite 0.20. Please have a look at the changelog for important update information.