dirout / dokkoo Goto Github PK
View Code? Open in Web Editor NEWMokk (Macro Output Key Kit) implementation written in Rust.
Home Page: https://Dirout.github.io/dokkoo/dokkoo
License: GNU Affero General Public License v3.0
Mokk (Macro Output Key Kit) implementation written in Rust.
Home Page: https://Dirout.github.io/dokkoo/dokkoo
License: GNU Affero General Public License v3.0
TODO
comment in 6477ebb. It's been assigned to @undefined because they committed the code.There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.
Error type: undefined. Note: this is a nested preset so please contact the preset author if you are unable to fix it yourself.
TODO
comment in 3f6789a. It's been assigned to @undefined because they committed the code.TODO
comment in f9ded78. It's been assigned to @undefined because they committed the code.TODO
comment in 0cb5cda. It's been assigned to @undefined because they committed the code.TODO
comment in 6477ebb. It's been assigned to @undefined because they committed the code.Potential segfault in
localtime_r
invocations
Details | |
---|---|
Package | chrono |
Version | 0.4.19 |
URL | chronotope/chrono#499 |
Date | 2020-11-10 |
Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
No workarounds are known.
See advisory page for additional details.
Stack overflow in rustc_serialize when parsing deeply nested JSON
Details | |
---|---|
Package | rustc-serialize |
Version | 0.3.24 |
Date | 2022-01-01 |
When parsing JSON using json::Json::from_str
, there is no limit to the depth of the stack, therefore deeply nested objects can cause a stack overflow, which aborts the process.
Example code that triggers the vulnerability is
fn main() {
let _ = rustc_serialize::json::Json::from_str(&"[0,[".repeat(10000));
}
serde is recommended as a replacement to rustc_serialize.
See advisory page for additional details.
safemem is unmaintained
Details | |
---|---|
Status | unmaintained |
Package | safemem |
Version | 0.3.3 |
URL | https://github.com/abonander/safemem |
Date | 2023-02-14 |
The latest crates.io release was in 2019. The repository has been archived by the author.
See advisory page for additional details.
This is where information concerning patched security vulnerabilities will go after they are resolved, as per the security policy.
TODO
comment in f9ded78. It's been assigned to @undefined because they committed the code.TODO
comment in 6477ebb. It's been assigned to @undefined because they committed the code.stdweb is unmaintained
Details | |
---|---|
Status | unmaintained |
Package | stdweb |
Version | 0.4.20 |
URL | koute/stdweb#403 |
Date | 2020-05-04 |
The author of the stdweb
crate is unresponsive.
Maintained alternatives:
See advisory page for additional details.
TODO
comment in f9ded78. It's been assigned to @undefined because they committed the code.dirs is unmaintained, use dirs-next instead
Details | |
---|---|
Status | unmaintained |
Package | dirs |
Version | 2.0.2 |
URL | https://github.com/dirs-dev/dirs-rs |
Date | 2020-10-16 |
The dirs
crate is not maintained any more;
use dirs-next
instead.
See advisory page for additional details.
term is looking for a new maintainer
Details | |
---|---|
Status | unmaintained |
Package | term |
Version | 0.6.1 |
URL | Stebalien/term#93 |
Date | 2018-11-19 |
The author of the term
crate does not have time to maintain it and is looking
for a new maintainer.
Some maintained alternatives you can potentially switch to instead, depending
on your needs:
See advisory page for additional details.
TODO
comment in f9ded78. It's been assigned to @undefined because they committed the code.yaml-rust is unmaintained.
Details | |
---|---|
Status | unmaintained |
Package | yaml-rust |
Version | 0.4.5 |
URL | rustsec/advisory-db#1921 |
Date | 2024-03-20 |
The maintainer seems unreachable.
Many issues and pull requests have been submitted over the years
without any response.
Consider switching to the actively maintained yaml-rust2
fork of the original project:
See advisory page for additional details.
TODO
comment in 6477ebb. It's been assigned to @undefined because they committed the code.TODO
comment in 47894eb. It's been assigned to @undefined because they committed the code.This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
These updates have been manually edited so Renovate will no longer make changes. To discard all commits and start over, click on a checkbox.
These updates have all been created already. Click a checkbox below to force a retry/rebase of any.
These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.
Cargo.toml
actix-files 0.6.5
actix-http 3.7.0
actix-service 2.0.2
actix-web 4.7.0
ahash 0.8.11
chrono 0.4.38
clap 4.5.6
comrak 0.19.0
derive_more 0.99.17
futures 0.3.30
glob 0.3.1
html-minifier 4.0.0
latex2mathml 0.2.3
lazy_static 1.4.0
liquid 0.26.6
liquid-core 0.26.6
liquid-lib 0.26.6
miette 5.10.0
mimalloc 0.1.42
notify 6.1.1
path-clean 1.0.1
pathdiff 0.2.1
relative-path 1.9.3
serde 1.0.203
serde_yaml 0.9.34
sys-locale 0.3.1
ticky 1.0.2
tokio 1.38.0
wild 2.2.1
.github/workflows/aarch64.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions/upload-artifact v3
.github/workflows/annotate_code.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/clippy-check v1
.github/workflows/audit_on_change.yml
actions/checkout v4
actions-rs/audit-check v1
.github/workflows/aur.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions-rs/cargo v1
actions/upload-artifact v3
.github/workflows/check_code.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions-rs/cargo v1
.github/workflows/deb.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions-rs/cargo v1
actions/upload-artifact v3
.github/workflows/dependency-review.yml
actions/checkout v4
actions/dependency-review-action v3
.github/workflows/devskim.yml
actions/checkout v4
microsoft/DevSkim-Action v1
github/codeql-action v2
ubuntu 22.04
.github/workflows/fix_code.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions-rs/cargo v1
.github/workflows/format_code.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
.github/workflows/gh-pages.yml
actions-rs/toolchain v1
actions/checkout v4
actions/checkout v4
.github/workflows/lint_code.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
.github/workflows/mac-universal.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/toolchain v1
actions-rs/cargo v1
actions/upload-artifact v3
actions/upload-artifact v3
actions/upload-artifact v3
.github/workflows/publish_crate.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions-rs/cargo v1
actions-rs/cargo v1
.github/workflows/rpm.yml
actions-rs/toolchain v1
actions/upload-artifact v3
.github/workflows/rust-clippy.yml
actions/checkout v4
actions-rs/toolchain v1@16499b5e05bf2e26879000db0c1d13f7e13fa3af
github/codeql-action v2
.github/workflows/scheduled_audit.yml
actions/checkout v4
actions-rs/audit-check v1
.github/workflows/shiftleft_analysis.yml
actions/checkout v4
github/codeql-action v2
.github/workflows/tests.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions-rs/cargo v1
.github/workflows/update_deps.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions-rs/cargo v1
actions-rs/cargo v1
actions-rs/cargo v1
.github/workflows/windows.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions/upload-artifact v3
.github/workflows/x86_64.yml
actions/checkout v4
actions-rs/toolchain v1
actions-rs/cargo v1
actions/upload-artifact v3
Multiple memory safety issues
Details | |
---|---|
Package | actix-web |
Version | 4.0.0-beta.3 |
URL | actix/actix-web#289 |
Date | 2018-06-08 |
Patched versions | >=0.7.15 |
Affected versions contain multiple memory safety issues, such as:
Send
marker trait to objects that cannot be safely sent between threadsThis may result in a variety of memory corruption scenarios, most likely use-after-free.
A signficant refactoring effort has been conducted to resolve these issues.
See advisory page for additional details.
TODO
comment in 0007dee. It's been assigned to @undefined because they committed the code.Potential segfault in the time crate
Details | |
---|---|
Package | time |
Version | 0.1.44 |
URL | time-rs/time#293 |
Date | 2020-11-18 |
Patched versions | >=0.2.23 |
Unaffected versions | =0.2.0,=0.2.1,=0.2.2,=0.2.3,=0.2.4,=0.2.5,=0.2.6 |
Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.
The affected functions from time 0.2.7 through 0.2.22 are:
time::UtcOffset::local_offset_at
time::UtcOffset::try_local_offset_at
time::UtcOffset::current_local_offset
time::UtcOffset::try_current_local_offset
time::OffsetDateTime::now_local
time::OffsetDateTime::try_now_local
The affected functions in time 0.1 (all versions) are:
at
at_utc
now
Non-Unix targets (including Windows and wasm) are unaffected.
Pending a proper fix, the internal method that determines the local offset has been modified to always return None
on the affected operating systems. This has the effect of returning an Err
on the try_*
methods and UTC
on the non-try_*
methods.
Users and library authors with time in their dependency tree should perform cargo update
, which will pull in the updated, unaffected code.
Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3 series.
No workarounds are known.
See advisory page for additional details.
arr! macro erases lifetimes
Details | |
---|---|
Package | generic-array |
Version | 0.12.3 |
URL | fizyk20/generic-array#98 |
Date | 2020-04-09 |
Patched versions | >=0.14.0 |
Unaffected versions | <0.8.0 |
Affected versions of this crate allowed unsoundly extending
lifetimes using arr!
macro. This may result in a variety of
memory corruption scenarios, most likely use-after-free.
See advisory page for additional details.
net2
crate has been deprecated; usesocket2
instead
Details | |
---|---|
Status | unmaintained |
Package | net2 |
Version | 0.2.35 |
URL | deprecrated/net2-rs@3350e38 |
Date | 2020-05-01 |
The net2
crate has been deprecated
and users are encouraged to considered socket2
instead.
See advisory page for additional details.
Use-after-free in BodyStream due to lack of pinning
Details | |
---|---|
Package | actix-http |
Version | 3.0.0-beta.3 |
URL | actix/actix-web#1321 |
Date | 2020-01-24 |
Patched versions | >=2.0.0-alpha.1 |
Affected versions of this crate did not require the buffer wrapped in BodyStream
to be pinned,
but treated it as if it had a fixed location in memory. This may result in a use-after-free.
The flaw was corrected by making the trait MessageBody
require Unpin
and making poll_next()
function accept Pin<&mut Self>
instead of &mut self
.
See advisory page for additional details.
Potential request smuggling capabilities due to lack of input validation
Details | |
---|---|
Package | actix-http |
Version | 3.0.0-beta.5 |
Date | 2021-06-16 |
Patched versions | >=2.2.1, <3.0.0,>=3.0.0-beta.9 |
Affected versions of this crate did not properly detect invalid requests that could allow HTTP/1 request smuggling (HRS) attacks when running alongside a vulnerable front-end proxy server. This can result in leaked internal and/or user data, including credentials, when the front-end proxy is also vulnerable.
Popular front-end proxies and load balancers already mitigate HRS attacks so it is recommended that they are also kept up to date; check your specific set up. You should upgrade even if the front-end proxy receives exclusively HTTP/2 traffic and connects to the back-end using HTTP/1; several downgrade attacks are known that can also expose HRS vulnerabilities.
See advisory page for additional details.
TODO
comment in f9ded78. It's been assigned to @undefined because they committed the code.TODO
comment in 17c4946. It's been assigned to @undefined because they committed the code.anymap is unmaintained.
Details | |
---|---|
Status | unmaintained |
Package | anymap |
Version | 0.12.1 |
URL | chris-morgan/anymap#37 |
Date | 2021-05-07 |
The anymap
crate does not appear to be maintained, and the most recent
published version 0.12.1 includes a soundness bug. This has been
fixed a few years ago, but
was never released.
See advisory page for additional details.
Use-after-free in Framed due to lack of pinning
Details | |
---|---|
Package | actix-codec |
Version | 0.4.0-beta.1 |
URL | actix/actix-net#91 |
Date | 2020-01-30 |
Patched versions | >=0.3.0-beta.1 |
Affected versions of this crate did not require the buffer wrapped in Framed
to be pinned,
but treated it as if it had a fixed location in memory. This may result in a use-after-free.
The flaw was corrected by making the affected functions accept Pin<&mut Self>
instead of &mut self
.
See advisory page for additional details.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.