Open github-actions[bot] opened 4 months ago
This appears to have silenced in main https://github.com/sigstore/sigstore-rs/pull/387/files
This that a temporary solution, do we plan on monitoring this further?
A new warning has taken its place: https://rustsec.org/advisories/RUSTSEC-2023-0086
I've created https://github.com/timothee-haudebourg/json-number/pull/6 that addresses both issues.
lexical
6.1.1
lexical
contains multiple soundness issues:BytesIter
trait has safety invariants but is public and not markedunsafe
write_float()
callsMaybeUninit::assume_init()
on uninitialized data, which is is not allowed by the Rust abstract machineThe crate also has some correctness issues and appears to be unmaintained.
Alternatives
For quickly parsing floating-point numbers third-party crates are no longer needed. A fast float parsing algorith by the author of
lexical
has been merged into libcore.For quickly parsing integers, consider
atoi
andbtoi
crates (100% safe code).atoi_radix10
provides even faster parsing, but only with-C target-cpu=native
, and at the cost of someunsafe
.For formatting integers in a
#[no_std]
context consider thenumtoa
crate.For working with big numbers consider
num-bigint
andnum-traits
.See advisory page for additional details.