mirror of
https://github.com/imjasonh/rustvulncheck
synced 2026-07-16 20:43:49 +00:00
76921cfde0
Scanner fixes: - Block comment tracking: skip lines inside /* ... */ blocks - Skip `use` statements from being matched as call sites - Free function call detection: `parse_cookie(...)` after direct import - Type-aware suppression: when the receiver's type is positively known and doesn't match the vulnerable type, suppress the finding entirely (e.g., .abort() on MyHandle vs JoinHandle) Golden test improvements: - All assertions are now specific: exact counts (deps, reachable symbols, files scanned), exact advisory IDs listed vs reachable, exact call site locations (file:line), exact confidence levels (HIGH vs MEDIUM) - Each test documents its fixture layout and expected positive/negative findings in a header comment New edge_cases_project fixture covering: - Aliased imports (Decoder as HyperDecoder → dec.decode detected) - Free function calls (parse_cookie after direct import) - Commented-out code (block & line comments correctly skipped) - False positive suppression (abort() on MyHandle, parse() on String) - Typed method calls (jar.add(c) with explicit CookieJar type) 38 tests total (33 unit + 5 integration), all passing. https://claude.ai/code/session_011sdj18ZvQYbDVwEKqrWDj1
105 lines
2.9 KiB
JSON
105 lines
2.9 KiB
JSON
{
|
|
"generated_at": "unix:1700000000",
|
|
"entries": [
|
|
{
|
|
"advisory_id": "RUSTSEC-2024-0001",
|
|
"package": "hyper",
|
|
"title": "Lenient HTTP header parsing allows request smuggling",
|
|
"date": "2024-01-15",
|
|
"patched_versions": [">= 1.0.0"],
|
|
"commit_sha": "abc123",
|
|
"vulnerable_symbols": [
|
|
{
|
|
"file": "src/proto/h1/role.rs",
|
|
"function": "hyper::proto::h1::role::Client::encode",
|
|
"change_type": "Modified"
|
|
},
|
|
{
|
|
"file": "src/proto/h1/decode.rs",
|
|
"function": "hyper::proto::h1::decode::Decoder::decode",
|
|
"change_type": "Modified"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"advisory_id": "RUSTSEC-2024-0010",
|
|
"package": "smallvec",
|
|
"title": "Buffer overflow in SmallVec::insert_many",
|
|
"date": "2024-02-20",
|
|
"patched_versions": [">= 1.11.0"],
|
|
"commit_sha": "def456",
|
|
"vulnerable_symbols": [
|
|
{
|
|
"file": "src/lib.rs",
|
|
"function": "smallvec::SmallVec::insert_many",
|
|
"change_type": "Modified"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"advisory_id": "RUSTSEC-2024-0020",
|
|
"package": "tokio",
|
|
"title": "Race condition in task abort",
|
|
"date": "2024-03-01",
|
|
"patched_versions": [">= 1.38.0"],
|
|
"commit_sha": "ghi789",
|
|
"vulnerable_symbols": [
|
|
{
|
|
"file": "src/runtime/task/mod.rs",
|
|
"function": "tokio::runtime::task::JoinHandle::abort",
|
|
"change_type": "Modified"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"advisory_id": "RUSTSEC-2024-0030",
|
|
"package": "regex",
|
|
"title": "ReDoS in regex compilation",
|
|
"date": "2024-04-01",
|
|
"patched_versions": [">= 1.10.0"],
|
|
"commit_sha": "jkl012",
|
|
"vulnerable_symbols": [
|
|
{
|
|
"file": "src/compile.rs",
|
|
"function": "regex::compile::Compiler::compile",
|
|
"change_type": "Modified"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"advisory_id": "RUSTSEC-2024-0040",
|
|
"package": "serde_json",
|
|
"title": "Stack overflow on deeply nested input",
|
|
"date": "2024-05-01",
|
|
"patched_versions": [">= 1.0.100"],
|
|
"commit_sha": "mno345",
|
|
"vulnerable_symbols": [
|
|
{
|
|
"file": "src/de.rs",
|
|
"function": "serde_json::de::Deserializer::parse",
|
|
"change_type": "Modified"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"advisory_id": "RUSTSEC-2024-0050",
|
|
"package": "cookie",
|
|
"title": "Cookie parsing allows header injection",
|
|
"date": "2024-06-01",
|
|
"patched_versions": [">= 0.18.0", ">= 0.17.1, < 0.18.0"],
|
|
"commit_sha": "pqr678",
|
|
"vulnerable_symbols": [
|
|
{
|
|
"file": "src/parse.rs",
|
|
"function": "cookie::parse::parse_cookie",
|
|
"change_type": "Modified"
|
|
},
|
|
{
|
|
"file": "src/jar.rs",
|
|
"function": "cookie::jar::CookieJar::add",
|
|
"change_type": "Modified"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|