This project contains known security vulnerabilities. Find detailed information at the bottom.
repub(12 total, 6 outdated, 1 insecure)
| Crate | Required | Latest | Status |
|---|---|---|---|
| failure | ^0.1 | 0.1.8 | up to date |
| comrak ⚠️ | ^0.6 | 0.55.0 | insecure |
| clap | ^2 | 4.6.7 | out of date |
| rand | ^0.7 | 0.10.2 | out of date |
| chrono | ^0.4 | 0.4.45 | up to date |
| html5ever | ^0.24 | 0.40.1 | out of date |
| zip | ^0.5 | 8.6.0 | out of date |
| serde | ^1.0 | 1.0.229 | up to date |
| serde_json | ^1.0 | 1.0.151 | up to date |
| colored_truecolor | ^0.1.0 | 0.1.0 | up to date |
| log | ^0.4 | 0.4.34 | up to date |
| env_logger | ^0.6 | 0.11.11 | out of date |
comrak: XSS in `comrak`The comrak we were matching unsafe URL prefixes, such as data: or javascript: , in a case-sensitive manner. This meant prefixes like Data: were untouched.
comrak: XSS in `comrak`comrak operates by default in a "safe" mode of operation where unsafe content, such as arbitrary raw HTML or URLs with non-standard schemes, are not permitted in the output. This is per the reference GFM implementation, cmark-gfm.
Ampersands were not being correctly escaped in link targets, making it possible
to fashion unsafe URLs using schemes like data: or javascript: by entering
them as HTML entities, e.g. data:. The intended
behaviour, demonstrated upstream, is that these should be escaped and therefore
harmless, but this behaviour was broken in comrak.