Update Rust crate diesel to v2.3.8 [SECURITY]#123
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
2.2.9→2.3.82.2.9→2.3.8Diesel's SQLite backend has possible UTF-8 corruption
GHSA-h5x4-m2qf-r4f2
More information
Details
Diesel uses the
sqlite3_value_textfunction to receive strings from SQLite while deserializing query results. We misinterpreted the corresponding SQLite documentation that this function always returns a UTF-8 encoded string values as*const c_char. Based on that we usedstr::from_utf8_uncheckedto construct a Rust string slice without any additional UTF-8 checks in place. It turned out that this function doesn't always return correct UTF-8 strings. For field of the SQLite side storage typeBLOBthis pointer can contain arbitrary bytes, which makes the usage ofstr::from_utf8_uncheckedunsound as this violates the safety contract ofstrto only contain valid UTF-8 encoded Strings.Mitigation
The preferred mitigation to the outlined problem is to update to a Diesel version 2.3.8 or newer, which includes fixes for the problem.
Resolution
Diesel now correctly checks whether the provides byte buffer is actually valid UTF-8, instead of relying on SQLite's documentation. This fix is included in the
2.3.8release.Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Diesel: Possible unaligned data access for implementations of
SqliteAggregateGHSA-q8x8-jrhj-fh9p
More information
Details
Diesel allows to register custom aggregate SQL functions for SQLite via the
SqliteAggregateinterface.To store an instance of the custom aggregate processor Diesel relied on the
sqlite3_aggregate_contextfunction provided by sqlite. This function doesn't provide any guarantees about alignment of the returned allocation, which in turn can lead to problems if the type implementing requires a special alignment, e.g. via a custom#[align(x)]attribute on the type implementing this trait. This affects any user ofSqliteAggregatethat registers the custom aggregate function with an SQLite connection, while using a non-standard alignment on the type implementing this trait.Mitigation
The preferred mitigation to the outlined problem is to update to a Diesel version 2.3.8 or newer, which includes fixes for the problem.
Resolution
Diesel now allocates the corresponding memory on Rust side to get a correctly aligned allocation.
Severity
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Diesel: Command injection in Diesel's implementation of
COPY FROM/COPY TOGHSA-m9p2-fxp5-v3fp
More information
Details
Diesel allows users to configure various options for PostgreSQL's
COPY FROMandCOPY TOstatements. These configurations are partially provided as strings or characters.Diesel did not check if any these user-provided options contain a quote character
', which can lead to the injection of additional options in the currentCOPY FROM/COPY TOstatement.This vulnerability affects any user of
COPY FROM/COPY TOthat passes user-provided input to any of the affected functions. It can result in modifications of options in the current statement, but it is not possible inject additional statements.Mitigation
The preferred mitigation to the outlined problem is to update to Diesel version 2.3.8 or newer, which includes fixes for the problem.
Resolution
Diesel now correctly escapes any quotes contained in the provided arguments.
Severity
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
diesel-rs/diesel (diesel)
v2.3.8Compare Source
ORDER BYclause without aGROUP BYclause.count()or.select(aggregate_expr)on a query that already has a non-aggregate.order_by()clause now raises a compile-time error instead of generating invalid SQL that would be rejected by the database at runtime (fixes #3815)#[derive(AsChangeset)]infix_operator!()SqliteValue::read_text/FromSql<Text, Sqlite> for StringSqliteConnection::register_functionfor aggregate functionsSqliteConnection::register_functionCOPY FROM/TODebug/Displayimplementation of batchINSERTstatements for SQLiteSqliteValue::read_text/FromSql<Text, Sqlite> for String/SqliteValue::read_blob()/FromSql<Binary, Sqlite> for Vec<u8>FromSql<Binary, _> for Vec<u8>andFromSql<Text, _> for Stringfor third party backends (requires changes to the third party backend as well)v2.3.7Compare Source
v2.3.6Compare Source
table#[derive(Insertable)]if the same field type is used with different lifetime valuesv2.3.5Compare Source
#[derive(Insertable)]returning_clauses_for_sqlite_3_35feature enable thesqlitefeature by defaultv2.3.4Compare Source
#[diesel(embed)]withOption<Inner>typesv2.3.3Compare Source
Fixed
#[derive(MultiConnection)]Okin code generated by derives to avoid naming conflictsv2.3.2Fixed
v2.3.1This version did not contain any changes, but only a version bump to retrigger the docs.rs build
v2.3.0Compare Source
Added
limit()andoffset()DSL to combination clauses such asUNION#[derive(Identifiable)]ignoring attribute#[diesel(serialize_as)]on primary keysAsChangesetvia#[diesel(embed)]#[diesel(skip_update)]attribute for theAsChangesetderive to skip updating a field present in the structdiesel::r2d2::TestCustomizer, which allows users to customize theirdiesel::r2d2::Poolsin a way that makes the pools suitable for use in parallel tests.
JsonandJsonbsupport for the SQLite backend.#[diesel::declare_sql_function]attribute macro to easily define support formultiple sql functions at once via an
extern "SQL"block[print_schema] allow_tables_to_appear_in_same_query_config = "fk_related_tables"to generate separateallow_tables_to_appear_in_same_query!calls containing only tables that are related through foreign keys. (Default:"all_tables".) It is not possible to build queries using two tables that don't appear in the sameallow_tables_to_appear_in_same_query!call, but that macro generates O(n²) rust code, so this option may be useful to reduce compilation time. (#4333)wasm32-unknown-unknowntarget support for sqlite backend.CASToperator[print_schema] allow_tables_to_appear_in_same_query_config = "none"to generate noallow_tables_to_appear_in_same_query!calls. (Default:"all_tables".). (#4333)[print_schema] pg_domains_as_custom_typesparameter to generate custom types for PostgreSQL domains that matches any of the regexes in the given list. (Default:[].) This option allows an application to selectively give special meaning for the serialization/deserialization of these types, avoiding the default behavior of treating the domain as the underlying type. (#4592)Fixed
a.eq_any(b)was non-nullable even ifaandbwere nullable.InstrumentationEvent::BeginTransactionfor immediate and exclusive transactions in SQLiteDELETE FROM.ipnetworkto allow version 0.21.Changed
DIESEL_LOGlogging filter env variable instead of the defaultRUST_LOGone (#4575)v2.2.12Compare Source
v2.2.11Compare Source
v2.2.10Compare Source
Configuration
📅 Schedule: (in timezone America/Los_Angeles)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
This PR was generated by Mend Renovate. View the repository job log.