Hosted composer.lock rewrite splices the server's url and sha1 through expanding Regex::replace with no validation or JSON escaping

Abierto
  • ¿Algo no está bien?
#1,934 1 comentario 0 reacciones 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

Nadie ha tomado este issue todavía.

Evaluación

Dificultad
3/5
Tiempo estimado
Medio día
Aptitud para principiantes
55/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
rust
Área
build-system, security

Línea de trabajo

Start in formats/composer/hosted.rs around L268-L281, where the url and sha1 are spliced into the rewritten composer.lock through regex replacement, then check the vendored-path test at L232-L233. Compare the sha1 check in patch/redirect/mod.rs near L1988 and the parse_vendor_path helper used by wired_to. Done means a url containing $1 and a quote produces valid JSON with the exact url, and a non-hex sha1 is refused with a warning, with the existing composer equivalence tests still passing.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

agent:triaged arch-audit bug priority:p2

[agent] Filed by the scheduled architecture audit (audit-core). Register: register.

Kind: bug (missing validator; extends A06). Register ID: A56.

Problem

formats/composer/hosted.rs L268-L281 builds the replacement text from server-supplied values:

rewritten = url_re.replace(&rewritten, format!("${{1}}{}${{2}}", dep.artifact_url).as_str())
...
shasum_re.replace(&rewritten, format!("${{1}}{sha1}${{2}}").as_str())
  • The replacer expands $n/${name} inside the url and the sha1.
  • Neither value is JSON-escaped.
  • The sha1 is never checked to be 40 lowercase hex.

The cargo hosted path does validate its checksum (redirect/mod.rs L1988).

Executed (a scratch copy at cbbbdb9): url …?s=$1&q="z with sha1 not"hex$2 produces "url": "https://h.test/x?s="url": "&q="z", and the rewritten composer.lock no longer parses as JSON.

The vendored check at L232-L233 is a hand-rolled ".socket/vendor/" prefix test, where mod.rs's wired_to uses parse_vendor_path.

Proposed change

  • Refuse the dep unless digest::sha1_hex-style validation passes.
  • Serialize the url with serde_json::to_string and splice it with regex::NoExpand.
  • Use parse_vendor_path for the vendored check.

Size

1 file, about ±25 lines, plus 2 tests.

Acceptance criteria

  • New tests: a url containing $1 and " round-trips to valid JSON with the exact url, and a non-hex sha1 is refused with a warning code.
  • Composer equivalence tests pass.
Lenguaje dominante
Rust
Estrellas
9
Forks
2
Merge medio
20 h 47 min
PR fusionados (30 d)
681

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de SocketDev/socket-patch

Todos los issues de SocketDev/socket-patch

Issues similares

Más issues de Rust

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.