chore(deps): update rust crate serde_with to v3.21.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
serde_with	dependencies	minor	3.12.0 → 3.21.0

---

serde_with: KeyValueMap serialization panics on empty sequence or map entries

GHSA-7gcf-g7xr-8hxj

More information

Details

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

• Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
• Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

• serde_with/src/key_value_map.rs:590
• serde_with/src/key_value_map.rs:599
• serde_with/src/key_value_map.rs:613
• serde_with/src/key_value_map.rs:632
• serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]

#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]

#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj
• https://github.com/jonasbb/serde_with/pull/966
• https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389
• https://github.com/jonasbb/serde_with/releases/tag/v3.21.0
• https://github.com/advisories/GHSA-7gcf-g7xr-8hxj

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jonasbb/serde_with (serde_with)

v3.21.0: serde_with v3.21.0

Compare Source

Security

• GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries
  Bad or attacker controlled values could cause a panic while allocating too large values.
  Fixed in #​966 by setting a maximum allocation size during the creation of collections like Vec or sets.

  Thanks to @​7thParkk for reporting the issue.

Added

• Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#​486)

Changed

• Re-enable link-to-definition on docs.rs (#​964)

Fixed

• Fix some doc links to point to the correct types (#​963)
• Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#​962)

v3.20.0: serde_with v3.20.0

Compare Source

Added

• Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#​943)

Fixed

• Extend base64 with schemars support by @​mitinarseny (#​9949)

v3.19.0: serde_with v3.19.0

Compare Source

Added

• Add support for hashbrown v0.17 (#​940)

  This extends the existing support for hashbrown to the newly released version.

v3.18.0: serde_with v3.18.0

Compare Source

Added

• Support OneOrMany with more sequence and set types (#​929)

Changed

• Bump MSRV to 1.88 due to the darling dependency

v3.17.0: serde_with v3.17.0

Compare Source

Added

• Support OneOrMany with smallvec v1 (#​920, #​922)

Changed

• Switch to yaml_serde for a maintained yaml dependency by @​kazan417 (#​921)
• Bump MSRV to 1.82, since that is required for yaml_serde dev-dependency.

v3.16.1: serde_with v3.16.1

Compare Source

Fixed

• Fix JsonSchemaAs of SetPreventDuplicates and SetLastValueWins. (#​906, #​907)

v3.16.0: serde_with v3.16.0

Compare Source

Added

• Added support for smallvec v1 under the smallvec_1 feature flag by @​isharma228 (#​895)
• Add JsonSchemaAs implementation for json::JsonString by @​yogevm15 (#​901)

v3.15.1: serde_with v3.15.1

Compare Source

Fixed

• Fix building of the documentation by updating references to use serde_core.

v3.15.0: serde_with v3.15.0

Compare Source

Added

• Added error inspection to VecSkipError and MapSkipError by @​michelhe (#​878)
  This allows interacting with the previously hidden error, for example for logging.
  Checkout the newly added example to both types.

• Allow documenting the types generated by serde_conv!.
  The serde_conv! macro now acceps outer attributes before the optional visibility modifier.
  This allow adding doc comments in the shape of #[doc = "..."] or any other attributes, such as lint modifiers.

  serde_conv!(
      #[doc = "Serialize bools as string"]
      #[allow(dead_code)]
      pub BoolAsString,
      bool,
      |x: &bool| ::std::string::ToString::to_string(x),
      |x: ::std::string::String| x.parse()
  );

• Add support for hashbrown v0.16 (#​877)

  This extends the existing support for hashbrown v0.14 and v0.15 to the newly released version.

Changed

• Bump MSRV to 1.76, since that is required for toml dev-dependency.

v3.14.1: serde_with v3.14.1

Compare Source

Fixed

• Show macro expansion in the docs.rs generated rustdoc.
  Since macros are used to generate trait implementations, this is useful to understand the exact generated code.

v3.14.0: serde_with v3.14.0

Compare Source

Added

• Add support for Range, RangeFrom, RangeTo, RangeInclusive (#​851)
  RangeToInclusive is currently unsupported by serde.
• Add schemars implementations for Bound, Range, RangeFrom, RangeTo, RangeInclusive.
• Added support for schemars v1 under the schemars_1 feature flag

v3.13.0: serde_with v3.13.0

Compare Source

Added

• Added support for schemars v0.9.0 under the schemars_0_9 feature flag by @​swlynch99 (#​849)
• Introduce SerializeDisplayAlt derive macro (#​833)
  An alternative to the SerializeDisplay macro except instead of using the
  plain formatting like format!("{}", ...), it serializes with the
  Formatter::alternate flag set to true, like format!("{:#}", ...)

Changed

• Generalize serde_with::rust::unwrap_or_skip to support deserializing references by @​beroal (#​832)
• Bump MSRV to 1.71, since that is required for the jsonschema dev-dependency.
• Make serde_conv available without the std feature by @​arilou (#​839)
• Bump MSRV to 1.74, since that is required for schemars v0.9.0 by @​swlynch99 (#​849)

Fixed

• Make the DurationSeconds types and other variants more accessible even without std (#​845)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	cargo/​serde_with@​3.12.0 ⏵ 3.21.0	-12		+11

View full report

[github-actions]

Package Changes Through 33658d7

There are 14 changes which include tauri with minor, tauri-cli with minor, @tauri-apps/cli with minor, tauri-runtime with minor, tauri-runtime-wry with minor, tauri-utils with minor, tauri-bundler with minor, tauri-build with minor, tauri-macos-sign with minor, tauri-codegen with minor, tauri-macros with minor, tauri-plugin with minor, tauri-driver with minor, @tauri-apps/api with minor

Planned Package Versions

The following package releases are the planned based on the context of changes in this pull request.

package	current	next
@tauri-apps/api	2.11.1	2.12.0
tauri-utils	2.9.3	2.10.0
tauri-macos-sign	2.3.4	2.4.0
tauri-bundler	2.9.4	2.10.0
tauri-runtime	2.11.3	2.12.0
tauri-runtime-wry	2.11.4	2.12.0
tauri-codegen	2.6.3	2.7.0
tauri-macros	2.6.3	2.7.0
tauri-plugin	2.6.3	2.7.0
tauri-build	2.6.3	2.7.0
tauri	2.11.5	2.12.0
@tauri-apps/cli	2.11.4	2.12.0
tauri-cli	2.11.4	2.12.0
tauri-driver	2.0.6	2.1.0

Add another change file through the GitHub UI by following this link.

---

Read about change files or the docs at github.com/jbolda/covector