From d0e82ff0d7c7adc21b32ed81812e8ca000457cd0 Mon Sep 17 00:00:00 2001 From: Evan Richter Date: Sun, 26 Jun 2022 14:48:57 -0500 Subject: [PATCH] rulex advisory for string indexing panic (#1272) --- crates/rulex/RUSTSEC-0000-0000.md | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) create mode 100644 crates/rulex/RUSTSEC-0000-0000.md diff --git a/crates/rulex/RUSTSEC-0000-0000.md b/crates/rulex/RUSTSEC-0000-0000.md new file mode 100644 index 0000000..073868d --- /dev/null +++ b/crates/rulex/RUSTSEC-0000-0000.md @@ -0,0 +1,22 @@ +```toml +[advisory] +id = "RUSTSEC-0000-0000" +package = "rulex" +date = "2022-05-21" +url = "https://github.com/rulex-rs/rulex/security/advisories/GHSA-8v9w-p43c-r885" +categories = ["denial-of-service"] +aliases = ["CVE-2022-31100", "GHSA-8v9w-p43c-r885"] +[versions] +patched = [">= 0.4.3"] +``` + +# Panic due to improper UTF-8 indexing + +When parsing untrusted rulex expressions, rulex may panic, possibly enabling +a Denial of Service attack. This happens when the expression contains a multi- +byte UTF-8 code point in a string literal or after a backslash, because rulex +tries to slice into the code point and panics as a result. + +The flaw was corrected in commits `fac6d58b25` and `330b3534e7` by using +`len_utf8()` to derive character width in bytes instead of assuming ASCII +encoding of 1 byte per char.