chore(deny): accept quick-xml DoS advisories RUSTSEC-2026-0194/0195 (no upstream path) - #330
Conversation
…no upstream path) Fresh RustSec advisories on quick-xml 0.39.4 (quadratic duplicate-attribute check; unbounded namespace-declaration allocation — both DoS-class) fail the cargo-deny gate on every PR. No upgrade path exists anywhere in the ecosystem: datafusion 53.1 pins object_store ^0.13, and even object_store 0.14 pins quick-xml ^0.40 — both below the patched >=0.41. Accept both with a documented reason: quick-xml only parses XML responses from the operator-configured S3 endpoint (trusted infrastructure), and the impact is denial of service, not corruption or RCE. The ignore notes the removal condition — an object_store release on quick-xml >=0.41, likely via the DataFusion/Arrow upgrade (epic #314). Verified: `cargo deny check` → advisories ok, bans ok, licenses ok, sources ok. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 49 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Unblocks the repo-wide cargo deny gate by explicitly accepting two newly published RustSec DoS advisories affecting quick-xml that are currently unavoidable due to upstream dependency pinning (via datafusion → object_store).
Changes:
- Added
RUSTSEC-2026-0194andRUSTSEC-2026-0195tocargo-deny’s advisories ignore list. - Documented the justification and the concrete removal condition directly next to the ignore entries.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
What
CI is red repo-wide: two RustSec advisories published against
quick-xml 0.39.4today fail the
cargo denygate on every PR (first seen on #329, which touchesonly a workflow + docs):
AttributesNsReaderBoth are DoS-class. Patched in
quick-xml >= 0.41.0.Why ignore instead of upgrade
No upgrade path exists anywhere in the ecosystem right now:
datafusion 53.1pinsobject_store ^0.13(0.14 is semver-incompatible);object_store 0.14.0pinsquick-xml ^0.40.1— still below the patch.cargo update -p quick-xmlis a no-op under these constraints.Risk assessment
Low.
quick-xmlis used only byobject_storeto parse XML responses from theoperator-configured S3 endpoint — trusted infrastructure the operator points
Ourios at, not attacker-controlled input. Impact is denial of service, not
corruption or RCE.
The
deny.tomlentry carries the full reason and the removal condition: dropthe ignores when an
object_storerelease takesquick-xml >= 0.41— mostlikely via the DataFusion/Arrow upgrade (epic #314).
Verification
cargo deny check→ advisories ok, bans ok, licenses ok, sources ok.🤖 Generated with Claude Code