From 7f75ecd461c6fb6a88a721fa7110f2f94de69e66 Mon Sep 17 00:00:00 2001 From: Safe4U Date: Sat, 6 Jul 2024 20:13:10 +0800 Subject: [PATCH] Add advisory in `scanner-rust` --- crates/scanner-rust/RUSTSEC-0000-0000.md | 24 ++++++++++++++++++++++++ 1 file changed, 24 insertions(+) create mode 100644 crates/scanner-rust/RUSTSEC-0000-0000.md diff --git a/crates/scanner-rust/RUSTSEC-0000-0000.md b/crates/scanner-rust/RUSTSEC-0000-0000.md new file mode 100644 index 000000000..780bbff96 --- /dev/null +++ b/crates/scanner-rust/RUSTSEC-0000-0000.md @@ -0,0 +1,24 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "scanner-rust" +date = "2024-07-06" +url = "https://github.com/magiclen/scanner-rust/issues/2" +informational = "unsound" +categories = ["format-injection"] + +[affected] +functions = { "scanner-rust::ScannerU8SliceAscii::new" = ["<= 2.0.17"] } + +[versions] +patched = [] +``` + +# Create and parse non-utf8 str in `ScannerU8SliceAscii` + +`ScannerU8SliceAscii` uses lots of unsafe function `from_utf8_unchecked` to directly +convert the `[u8]` to `str` and then parse it to target type. + +However, there is no validation in `ScannerU8SliceAscii::new` to guarantee the `data` +is Ascii. So if the `ScannerU8SliceAscii` is used to scan the non-utf8 bytes, non-utf8 +str would be generated and passed it to `parse` which might lead to undefined behaviors. \ No newline at end of file