Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(deps): update rust crate sqlx to 0.8.1 [security] - autoclosed #404

Closed
wants to merge 1 commit into from

Conversation

renovate[bot]
Copy link
Contributor

@renovate renovate bot commented Sep 2, 2024

This PR contains the following updates:

Package Type Update Change
sqlx dependencies minor 0.7.4 -> 0.8.1
sqlx dev-dependencies minor 0.7.4 -> 0.8.1

GitHub Vulnerability Alerts

GHSA-xmrp-424f-vfpx

The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord:

SQL Injection isn't Dead: Smuggling Queries at the Protocol Level
http://web.archive.org/web/20240812130923/https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf
(Archive link for posterity.)

Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow,
causing the server to interpret the rest of the string as binary protocol commands or other data.

It appears SQLx does perform truncating casts in a way that could be problematic,
for example: https://github.com/launchbadge/sqlx/blob/6f2905695b9606b5f51b40ce10af63ac9e696bb8/sqlx-postgres/src/arguments.rs#L163

This code has existed essentially since the beginning,
so it is reasonable to assume that all published versions <= 0.8.0 are affected.

Mitigation

As always, you should make sure your application is validating untrustworthy user input.
Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB.
Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.

Encode::size_hint()
can be used for sanity checks, but do not assume that the size returned is accurate.
For example, the Json<T> and Text<T> adapters have no reasonable way to predict or estimate the final encoded size,
so they just return size_of::<T>() instead.

For web application backends, consider adding some middleware that limits the size of request bodies by default.

Resolution

Work has started on a branch to add #[deny] directives for the following Clippy lints:

and to manually audit the code that they flag.

A fix is expected to be included in the 0.8.1 release (still WIP as of writing).


Release Notes

launchbadge/sqlx (sqlx)

v0.8.1

Compare Source

16 pull requests were merged this release cycle.

This release contains a fix for RUSTSEC-2024-0363.

Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated:
#​3440 (comment)

MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.

Added
  • [#​3421]: correct spelling of MySqlConnectOptions::no_engine_substitution() [[@​kolinfluence]]
    • Deprecates MySqlConnectOptions::no_engine_subsitution() (oops) in favor of the correctly spelled version.
Changed
  • [#​3376]: doc: hide spec_error module [[@​abonander]]
    • This is a helper module for the macros and was not meant to be exposed.
    • It is not expected to receive any breaking changes for the 0.8.x release, but is not designed as a public API.
      Use at your own risk.
  • [#​3382]: feat: bumped to libsqlite3-sys=0.30.1 to support sqlite 3.46 [[@​CommanderStorm]]
  • [#​3385]: chore(examples):Migrated the pg-chat example to ratatui [[@​CommanderStorm]]
  • [#​3399]: Upgrade to rustls 0.23 [[@​djc]]
    • RusTLS now has pluggable cryptography providers: ring (the existing implementation),
      and aws-lc-rs which has optional FIPS certification.
    • The existing features activating RusTLS (runtime-tokio-rustls, runtime-async-std-rustls, tls-rustls)
      enable the ring provider of RusTLS to match the existing behavior so this should not be a breaking change.
    • Switch to the tls-rustls-aws-lc-rs feature to use the aws-lc-rs provider.
      • If using runtime-tokio-rustls or runtime-async-std-rustls,
        this will necessitate switching to the appropriate non-legacy runtime feature:
        runtime-tokio or runtime-async-std
    • See the RusTLS README for more details: https://github.com/rustls/rustls?tab=readme-ov-file#cryptography-providers
Fixed

v0.8.0

Compare Source

70 pull requests were merged this release cycle.

#​2697 was merged the same day as release 0.7.4 and so was missed by the automatic CHANGELOG generation.

Breaking
  • [#​2697]: fix(macros): only enable chrono when time is disabled [[@​saiintbrisson]]
  • [#​2973]: Generic Associated Types in Database, replacing HasValueRef, HasArguments, HasStatement [[@​nitn3lav]]
  • [#​2482]: chore: bump syn to 2.0 [[@​saiintbrisson]]
    • Deprecated type ascription syntax in the query macros was removed.
  • [#​2736]: Fix describe on PostgreSQL views with rules [[@​tsing]]
    • Potentially breaking: nullability inference changes for Postgres.
  • [#​2869]: Implement PgHasArrayType for all references [[@​tylerhawkes]]
    • Conflicts with existing manual implementations.
  • [#​2940]: fix: Decode and Encode derives (#​1031) [[@​benluelo]]
    • Changes lifetime obligations for field types.
  • [#​3064]: Sqlite explain graph [[@​tyrelr]]
    • Potentially breaking: nullability inference changes for SQLite.
  • [#​3123]: Reorder attrs in sqlx::test macro [[@​bobozaur]]
    • Potentially breaking: attributes on #[sqlx::test] usages are applied in the correct order now.
  • [#​3126]: Make Encode return a result [[@​FSMaxB]]
  • [#​3130]: Add version information for failed cli migration (#​3129) [[@​FlakM]]
    • Breaking changes to MigrateError.
  • [#​3181]: feat: no tx migration [[@​cleverjam]]
    • (Postgres only) migrations that should not run in a transaction can be flagged by adding -- no-transaction to the beginning.
    • Breaking change: added field to Migration
  • [#​3184]: [BREAKING} fix(sqlite): always use i64 as intermediate when decoding [[@​abonander]]
    • integer decoding will now loudly error on overflow instead of silently truncating.
    • some usages of the query!() macros might change an i32 to an i64.
  • [#​3252]: fix #[derive(sqlx::Type)] in Postgres [[@​abonander]]
    • Manual implementations of PgHasArrayType for enums will conflict with the generated one. Delete the manual impl or add #[sqlx(no_pg_array)] where conflicts occur.
    • Type equality for PgTypeInfo is now schema-aware.
  • [#​3329]: fix: correct handling of arrays of custom types in Postgres [[@​abonander]]
    • Potential breaking change: PgTypeInfo::with_name() infers types that start with _ to be arrays of the un-prefixed type. Wrap type names in quotes to bypass this behavior.
  • [#​3356]: breaking: fix name collision in FromRow, return Error::ColumnDecode for TryFrom errors [[@​abonander]]
    • Breaking behavior change: errors with #[sqlx(try_from = "T")] now return Error::ColumnDecode instead of Error::ColumnNotFound.
    • Breaking because #[sqlx(default)] on an individual field or the struct itself would have previously suppressed the error.
      This doesn't seem like good behavior as it could result in some potentially very difficult bugs.
      • Instead, create a wrapper implementing From and apply the default explicitly.
  • [#​3337]: allow rename with rename_all (close #​2896) [[@​DirectorX]]
    • Changes the precedence of #[sqlx(rename)] and #[sqlx(rename_all)] to match the expected behavior (rename wins).
  • [#​3285]: fix: use correct names for sslmode options [[@​lily-mosquitoes]]
    • Changes the output of ConnectOptions::to_url_lossy() to match what parsing expects.
Added
Changed
Fixed

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot changed the title fix(deps): update rust crate sqlx to 0.8.1 [security] fix(deps): update rust crate sqlx to 0.8.1 [security] - autoclosed Sep 3, 2024
@renovate renovate bot closed this Sep 3, 2024
@renovate renovate bot deleted the renovate/crate-sqlx-vulnerability branch September 3, 2024 04:56
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants