rustsec_refs_imported() could possibly panic on short or malformed rustsec.org URLs
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 72/100
Research direction
Start in rustsec/src/osv/advisory.rs at rustsec_refs_imported() and inspect how advisory reference URLs are parsed. Reproduce the short and malformed rustsec.org URL cases described in the issue, then run the project's tests. Done means these inputs no longer panic while valid advisory references continue to produce IDs.
Written by the indexing model from the issue text.
Description
Summary
I see hardcoded byte-range slice [31..48] usage in the function rustsec_refs_imported()
rustsec/src/osv/advisory.rs
/// Try to extract RustSec alias id from OSV advisory metadata
pub fn rustsec_refs_imported(&self) -> Vec<Id> {
let mut refs: Vec<Id> = self
.references
.iter()
.filter(|r| {
r.url
.as_str()
.starts_with("https://rustsec.org/advisories/")
})
.map(|r| Id::from_str(&r.url.as_str()[31..48]).expect("Invalid rustsec url"))
.collect();
refs.sort();
refs.dedup();
refs
}
It seems that the prefix "https://rustsec.org/advisories/" is 31 bytes.
The slice [31..48] assumes 17 more bytes for the following (the length of RUSTSEC-YYYY-NNNN) ?
URLs that match the prefix but are shorter than 48 bytes cause an out-of-bounds panic.
Also, URLs that are long enough but don't contain a valid advisory ID cause a panic from expect.
Reproduce
Create a reference URL that starts with https://rustsec.org/advisories/ but is shorter than 48 bytes, then call rustsec_refs_imported()
- Dominant language
- Rust
- Stars
- 2k
- Forks
- 198
- Avg merge
- 3d 3h
- Merged PRs (30d)
- 11
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rustsec/rustsec
-
Difficulty 4/5 3-5 days Newbie friendliness 35/100
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
Difficulty 3/5 1-2 days Newbie friendliness 48/100
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
Similar issues
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
bitcoindevkit/bdk-ffi#1125 ·