disable default chrono features, fix potential segfault in the time crate - Githubissues

tag1consulting / goose

Load testing framework, inspired by Locust

https://tag1.com/goose

Apache License 2.0

799 stars 71 forks source link

disable default chrono features, fix potential segfault in the time crate #559

Closed jeremyandrews closed 1 year ago

jeremyandrews commented 1 year ago

fixes https://github.com/tag1consulting/goose/issues/558
only enable required features from chrono, addressing https://rustsec.org/advisories/RUSTSEC-2020-0071

A possible workaround for crates affected through the transitive dependency in chrono, is to avoid using the default oldtime feature dependency of the chrono crate by disabling its default-features and manually specifying the required features instead.

source of the fix: https://github.com/chronotope/chrono/issues/602#issuecomment-1242149249

This fixes the following issue detailed at the link above:

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

jeremyandrews commented 1 year ago

@LionsAd I don't see the need to declare this a security release, worst-case it seems anther user on the server running the load test could cause the load test to segfault. In general, it would be unwise to run a load test on a shared server anyway. If you agree, we can go ahead and merge as-is.