cot 0.4.0

Crate cot

Dependencies

(53 total, 5 outdated, 1 possibly insecure)

Crate	Required	Latest	Status
aide	`^0.15`	`0.15.1`	up to date
askama	`^0.14`	`0.15.1`	out of date
async-trait	`^0.1`	`0.1.89`	up to date
axum	`^0.8`	`0.8.8`	up to date
backtrace	`^0.3`	`0.3.76`	up to date
bytes	`^1.10`	`1.11.0`	up to date
chrono	`^0.4.41`	`0.4.43`	up to date
chrono-tz	`^0.10.4`	`0.10.4`	up to date
clap	`^4`	`4.5.54`	up to date
cot_macros	`^0.4.0`	`0.4.0`	up to date
deadpool-redis	`^0.22`	`0.22.1`	up to date
derive_builder	`^0.20`	`0.20.2`	up to date
derive_more	`^2`	`2.1.1`	up to date
digest	`^0.10`	`0.10.7`	up to date
email_address	`^0.2.9`	`0.2.9`	up to date
fake	`^4`	`4.4.0`	up to date
form_urlencoded	`^1`	`1.2.2`	up to date
futures-core	`^0.3`	`0.3.31`	up to date
futures-util	`^0.3`	`0.3.31`	up to date
hex	`^0.4`	`0.4.3`	up to date
hmac	`^0.12`	`0.12.1`	up to date
http	`^1.3`	`1.4.0`	up to date
http-body	`^1`	`1.0.1`	up to date
http-body-util	`^0.1.3`	`0.1.3`	up to date
humantime	`^2`	`2.3.0`	up to date
indexmap	`^2`	`2.13.0`	up to date
mime	`^0.3`	`0.3.17`	up to date
mime_guess	`^2`	`2.0.5`	up to date
multer	`^3`	`3.1.0`	up to date
password-auth	`^1`	`1.0.0`	up to date
pin-project-lite	`^0.2`	`0.2.16`	up to date
redis	`^0.32`	`1.0.2`	out of date
schemars	`^0.9`	`1.2.0`	out of date
sea-query	`^0.32`	`0.32.7`	up to date
sea-query-binder	`^0.7`	`0.7.0`	up to date
serde	`^1`	`1.0.228`	up to date
serde_html_form	`^0.2`	`0.4.0`	out of date
serde_json	`^1`	`1.0.149`	up to date
serde_path_to_error	`^0.1.17`	`0.1.20`	up to date
sha2	`^0.10`	`0.10.9`	up to date
sqlx ⚠️	`^0.8`	`0.8.6`	maybe insecure
subtle	`^2`	`2.6.1`	up to date
swagger-ui-redist	`^0.1`	`0.1.0`	up to date
sync_wrapper	`^1`	`1.0.2`	up to date
thiserror	`^2`	`2.0.17`	up to date
time	`^0.3.42`	`0.3.45`	up to date
tokio	`^1.47`	`1.49.0`	up to date
toml	`^0.9`	`0.9.11+spec-1.1.0`	up to date
tower	`^0.5.2`	`0.5.3`	up to date
tower-livereload	`^0.9.6`	`0.10.2`	out of date
tower-sessions	`^0.14`	`0.14.0`	up to date
tracing	`^0.1`	`0.1.44`	up to date
url	`^2`	`2.5.8`	up to date

Crate

Required

Latest

Status

aide

^0.15

0.15.1

up to date

askama

^0.14

0.15.1

out of date

async-trait

^0.1

0.1.89

up to date

axum

^0.8

0.8.8

up to date

backtrace

^0.3

0.3.76

up to date

bytes

^1.10

1.11.0

up to date

chrono

^0.4.41

0.4.43

up to date

chrono-tz

^0.10.4

0.10.4

up to date

clap

^4

4.5.54

up to date

cot_macros

^0.4.0

0.4.0

up to date

deadpool-redis

^0.22

0.22.1

up to date

derive_builder

^0.20

0.20.2

up to date

derive_more

^2

2.1.1

up to date

digest

^0.10

0.10.7

up to date

email_address

^0.2.9

0.2.9

up to date

fake

^4

4.4.0

up to date

form_urlencoded

^1

1.2.2

up to date

futures-core

^0.3

0.3.31

up to date

futures-util

^0.3

0.3.31

up to date

hex

^0.4

0.4.3

up to date

hmac

^0.12

0.12.1

up to date

http

^1.3

1.4.0

up to date

http-body

^1

1.0.1

up to date

http-body-util

^0.1.3

0.1.3

up to date

humantime

^2

2.3.0

up to date

indexmap

^2

2.13.0

up to date

mime

^0.3

0.3.17

up to date

mime_guess

^2

2.0.5

up to date

multer

^3

3.1.0

up to date

password-auth

^1

1.0.0

up to date

pin-project-lite

^0.2

0.2.16

up to date

redis

^0.32

1.0.2

out of date

schemars

^0.9

1.2.0

out of date

sea-query

^0.32

0.32.7

up to date

sea-query-binder

^0.7

0.7.0

up to date

serde

^1

1.0.228

up to date

serde_html_form

^0.2

0.4.0

out of date

serde_json

^1

1.0.149

up to date

serde_path_to_error

^0.1.17

0.1.20

up to date

sha2

^0.10

0.10.9

up to date

sqlx ⚠️

^0.8

0.8.6

maybe insecure

subtle

^2

2.6.1

up to date

swagger-ui-redist

^0.1

0.1.0

up to date

sync_wrapper

^1

1.0.2

up to date

thiserror

^2

2.0.17

up to date

time

^0.3.42

0.3.45

up to date

tokio

^1.47

1.49.0

up to date

toml

^0.9

0.9.11+spec-1.1.0

up to date

tower

^0.5.2

0.5.3

up to date

tower-livereload

^0.9.6

0.10.2

out of date

tower-sessions

^0.14

0.14.0

up to date

tracing

^0.1

0.1.44

up to date

url

^2

2.5.8

up to date

Dev dependencies

(12 total, 3 outdated)

Crate	Required	Latest	Status
async-stream	`^0.3`	`0.3.6`	up to date
criterion	`^0.6`	`0.8.1`	out of date
fake	`^4`	`4.4.0`	up to date
fantoccini	`^0.22`	`0.22.0`	up to date
futures	`^0.3`	`0.3.31`	up to date
mockall	`^0.13`	`0.14.0`	out of date
reqwest	`^0.12`	`0.13.1`	out of date
rustversion	`^1`	`1.0.22`	up to date
serde_urlencoded	`^0.7`	`0.7.1`	up to date
tempfile	`^3`	`3.24.0`	up to date
tracing-test	`^0.2`	`0.2.5`	up to date
trybuild	`^1`	`1.0.114`	up to date

Crate

Required

Latest

Status

async-stream

^0.3

0.3.6

up to date

criterion

^0.6

0.8.1

out of date

fake

^4

4.4.0

up to date

fantoccini

^0.22

0.22.0

up to date

futures

^0.3

0.3.31

up to date

mockall

^0.13

0.14.0

out of date

reqwest

^0.12

0.13.1

out of date

rustversion

^1

1.0.22

up to date

serde_urlencoded

^0.7

0.7.1

up to date

tempfile

^3

3.24.0

up to date

tracing-test

^0.2

0.2.5

up to date

trybuild

^1

1.0.114

up to date

Security Vulnerabilities

`sqlx`: Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

RUSTSEC-2024-0363

The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord:

SQL Injection isn't Dead: Smuggling Queries at the Protocol Level
http://web.archive.org/web/20240812130923/https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
(Archive link for posterity.)

Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow, causing the server to interpret the rest of the string as binary protocol commands or other data.

It appears SQLx does perform truncating casts in a way that could be problematic, for example: https://github.com/launchbadge/sqlx/blob/6f2905695b9606b5f51b40ce10af63ac9e696bb8/sqlx-postgres/src/arguments.rs#L163

This code has existed essentially since the beginning, so it is reasonable to assume that all published versions <= 0.8.0 are affected.

Mitigation

As always, you should make sure your application is validating untrustworthy user input. Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB. Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.

Encode::size_hint() can be used for sanity checks, but do not assume that the size returned is accurate. For example, the Json<T> and Text<T> adapters have no reasonable way to predict or estimate the final encoded size, so they just return size_of::<T>() instead.

For web application backends, consider adding some middleware that limits the size of request bodies by default.

Resolution

sqlx 0.8.1 has been released with the fix: https://github.com/launchbadge/sqlx/blob/main/CHANGELOG.md#081---2024-08-23

Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated: https://github.com/launchbadge/sqlx/issues/3440#issuecomment-2307956901

MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.

Crate cot

Dependencies

Dev dependencies

Security Vulnerabilities

sqlx: Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

Mitigation

Resolution

Crate `cot`

`sqlx`: Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts