search

orhun / rustypaste-cli

A CLI tool for rustypaste
https://github.com/orhun/rustypaste
MIT License
56 stars 8 forks source link

RUSTSEC-2023-0050: multipart is Unmaintained #49

Open github-actions[bot] opened 1 year ago

github-actions[bot] commented 1 year ago

multipart is Unmaintained

Details
Status unmaintained
Package multipart
Version 0.18.0
URL []()
Date 2023-04-11

The multipart crate is unmaintained. The author has archived the github repository.

Alternatives:

See advisory page for additional details.

orhun commented 1 year ago

Ah hell nah

tessus commented 1 year ago

I currently only looked at how multer works, but maybe there is a way to use a framework that already allows multipart data. I am also not too familiar with streams in Rust, so I should probably not touch this code for now. The current issue I see is that ureq uses blocking IO, while most other frameworks use async. e.g. multer also uses async.

There is also a fork of multipart available ureq_multipart, but I have no idea of the status.

I don't know, maybe switching to another http client lib like reqwest might be a better move. But I really have no idea. Maybe @orhun can estimate the complexity of using an async multipart crate in a blocking env, versus changing the http client library.

orhun commented 1 year ago

I tried to implement rustypaste-cli with as few dependencies as possible so I went with ureq in the beginning. From the looks of our available options, it seems pretty bad/painful either way. I will look into it in more detail soon.

tessus commented 1 year ago

I understand. It makes perfect sense. ureq still seems to be maintained. So maybe the easiest would be for now just to use ureq_multipart.

In the future when you are bored you can always switch to an async http client. ;-)