RUSTSEC-2022-0048: xml-rs is Unmaintained

[github-actions[bot]]

xml-rs is Unmaintained

Details
Status	unmaintained
Package	xml-rs
Version	0.8.4
URL	https://github.com/netvl/xml-rs/issues
Date	2022-01-26

xml-rs is a XML parser has open issues around parsing including integer overflows / panics that may or may not be an issue with untrusted data.

Together with these open issues with Unmaintained status xml-rs may or may not be suited to parse untrusted data.

Alternatives

• quick-xml

See advisory page for additional details.

[fhennig]

Fix: migrate to quick-xml and replace escape_str_attribute in writer.rs with the quick-xml escape function.

• xml-rs function: https://docs.rs/xml-rs/latest/xml/escape/fn.escape_str_attribute.html
• quick-xml function: https://docs.rs/quick-xml/latest/quick_xml/escape/fn.escape.html

[nightkr]

xml-rs has been revived, and the advisory has been retracted.