Skip to content

add some audit ignores, remove resolved ones #2745

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 5, 2025
Merged

add some audit ignores, remove resolved ones #2745

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0dc77f0
add `ring` unmaintained to audit ignores
syphar Feb 22, 2025
464692e
add `proc-macro-error` to ignored audit warnings
syphar Feb 22, 2025
21a7cd5
remove resolved audit ignores
syphar Feb 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 6 additions & 13 deletions .cargo/audit.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,15 @@
[advisories]
ignore = [
"RUSTSEC-2023-0018", # rustwide -> remove_dir_all,TOCTOU / Race Condition
# https://github.com/rust-lang/docs.rs/issues/2074

"RUSTSEC-2023-0071", # potential key recovery through timing sidechannels

"RUSTSEC-2024-0013", # Memory corruption, denial of service, and arbitrary code execution in libgit2
# https://github.com/rust-lang/docs.rs/issues/2414
"RUSTSEC-2023-0071", # rsa: potential key recovery through timing sidechannels

"RUSTSEC-2024-0320", # yaml-rust is unmaintained.
# https://github.com/rust-lang/docs.rs/issues/2469

"RUSTSEC-2024-0363", # sqlx, Binary Protocol Misinterpretation caused by Truncating or Overflowing Cast
# https://github.com/rust-lang/docs.rs/issues/2588
# SECURITY:
# We have plenty of places where user input ends up in sql, for example the inner doc path for doc pages, crate names etc.
# But in all these places, the user content is part of the path of the URL.
# Since URL length is limited by cloudfront, and also by nginx, to something much smaller than 4 GiB, I don't think this issue affects us.
"RUSTSEC-2024-0370", # proc-macro-error is unmaintained
# https://github.com/rust-lang/docs.rs/issues/2595

"RUSTSEC-2025-0007", # `ring` is unmaintained. Not much we can do about it.
# https://github.com/rust-lang/docs.rs/issues/2741
]
informational_warnings = ["unmaintained"] # warn for categories of informational advisories
severity_threshold = "low" # CVSS severity ("none", "low", "medium", "high", "critical")
Expand Down
Loading