Fix cargo audit issue on chrono #1907

ysaito1001 · 2022-10-25T21:55:22Z

Motivation and Context

This PR addresses a cargo audit issue described in awslabs/aws-sdk-rust#643. ~~This will remain a draft until awslabs/aws-lambda-rust-runtime#556 is resolved.~~

Description

Within the top-level rust-runtime workspace, we can see the following report generated when running cargo audit:

Crate:     time
Version:   0.1.44
Title:     Potential segfault in the time crate
Date:      2020-11-18
ID:        RUSTSEC-2020-0071
URL:       https://rustsec.org/advisories/RUSTSEC-2020-0071
Solution:  Upgrade to >=0.2.23
Dependency tree:
time 0.1.44
└── chrono 0.4.22
    ├── aws_lambda_events 0.6.3
    │   └── lambda_http 0.6.2
    │       ├── aws-smithy-http-server-python 0.0.0-smithy-rs-head
    │       └── aws-smithy-http-server 0.0.0-smithy-rs-head
    │           ├── inlineable 0.0.0-smithy-rs-head
    │           └── aws-smithy-http-server-python 0.0.0-smithy-rs-head
    └── aws-smithy-types-convert 0.0.0-smithy-rs-head

To work around the issue, we follow this to avoid bringing in the time crate via the chrono crate. To that goal, this PR edits four Cargo.toml files.

Cargo.toml in aws-smithy-types-convert
This implements the said workaround.
Cargo.tomls in aws-smithy-http-server-python and aws-smithy-http-server
These crates indirectly stepped on the RustSec vulnerability in question from aws_lambda_events 0.6.3 (through lambda_http 0.6.2). aws_lambda_events addressed it as of 0.7.1 (PR) and lambda_http 0.7.1 ~~0.7.0~~, in turn, depended on a safe version of aws_lambda_events (PR). Thus, both aws-smithy-http-server-python and aws-smithy-http-server now depend on lambda_http 0.7.1 ~~0.7.0~~.
Cargo.toml in pokemon-service
This is due to b1cb5fa.

Testing

Ran cargo audit from within the top-level rust-runtime workspace:

$ rm Cargo.lock; cargo audit
    Fetching advisory database from `https://github.com/RustSec/advisory-db.git`
      Loaded 464 security advisories
    Updating crates.io index
    Updating crates.io index
    Scanning Cargo.lock for vulnerabilities (249 crate dependencies)

This is the output as a result of running cargo audit in this branch. We can see no vulnerabilities detected.

Checklist

I have updated CHANGELOG.next.toml if I made changes to the smithy-rs codegen or runtime crates

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

This commit is in response to RUSTSEC-2020-0071 where there is a potential segfault in the time crate. The aws-smithy-types-convert crate now disables the default features of the chrono crate so that it will not depend on the time crate.

This commit updates the version of lambda_http used by aws-smithy-http-server and aws-smithy-http-server-python to 0.7.0. The prior version 0.6.0 of lambda_http used the chrono crate in a way that exposed a security issue described in RUSTSEC-2020-0071. By switching to 0.7.0 of lambda_http, those two crates do not exhibit vulnerabilities as reported by cargo audit.

This commit removes --ignore flags for cargo audit related to the chrono crate. It is an accompanying PR for smithy-lang/smithy-rs#1907

github-actions · 2022-10-25T22:08:54Z

A new generated diff is ready to view.

AWS SDK (ignoring whitespace)
No codegen difference in the Server Test
No codegen difference in the Server Test Python

A new doc preview is ready to view.

github-actions · 2022-10-26T14:36:24Z

A new generated diff is ready to view.

AWS SDK (ignoring whitespace)
No codegen difference in the Server Test
No codegen difference in the Server Test Python

A new doc preview is ready to view.

This commit updates the version of `lambda_http` used by `pokemon-service` from 0.6.0 to 0.7.0. This is in sync with the fact that both `aws-smithy-http-server` and `aws-smithy-http-server-python` now depend on 0.7.0 of `lambda_http`. Failing to do so would cause `pokemon-service` to fail to compile due to an error at `lambda_http::run(handler)` in the main function of the `pokemon-service-lambda` binary: the trait `Service<lambda_http::http::Request<lambda_http::Body>>` is not implemented for `LambdaHandler<aws_smithy_http_server::routing::Router>`

github-actions · 2022-10-26T17:05:57Z

A new generated diff is ready to view.

AWS SDK (ignoring whitespace)
No codegen difference in the Server Test
No codegen difference in the Server Test Python

A new doc preview is ready to view.

This commit updates the version of `lambda_http` from 0.7.0 to 0.7.1 in the crates within the top-level `rust-runtime` workspace. These updates are needed to solve the issue described in awslabs/aws-lambda-rust-runtime#556

github-actions · 2022-10-28T19:55:31Z

A new generated diff is ready to view.

AWS SDK (ignoring whitespace)
No codegen difference in the Server Test
No codegen difference in the Server Test Python

A new doc preview is ready to view.

github-actions · 2022-10-28T20:29:39Z

A new generated diff is ready to view.

AWS SDK (ignoring whitespace)
No codegen difference in the Server Test
No codegen difference in the Server Test Python

A new doc preview is ready to view.

jdisanti

Nice work on this!

CHANGELOG.next.toml

…view-1161609833

github-actions · 2022-10-31T19:43:23Z

A new generated diff is ready to view.

AWS SDK (ignoring whitespace)
No codegen difference in the Server Test
No codegen difference in the Server Test Python

A new doc preview is ready to view.

* Avoid the chrono crate depending on the time crate This commit is in response to RUSTSEC-2020-0071 where there is a potential segfault in the time crate. The aws-smithy-types-convert crate now disables the default features of the chrono crate so that it will not depend on the time crate. * Depend on lambda_http without RUSTSEC-2020-0071 This commit updates the version of lambda_http used by aws-smithy-http-server and aws-smithy-http-server-python to 0.7.0. The prior version 0.6.0 of lambda_http used the chrono crate in a way that exposed a security issue described in RUSTSEC-2020-0071. By switching to 0.7.0 of lambda_http, those two crates do not exhibit vulnerabilities as reported by cargo audit. * Bump minor version of lambda_http in pokemon-service This commit updates the version of `lambda_http` used by `pokemon-service` from 0.6.0 to 0.7.0. This is in sync with the fact that both `aws-smithy-http-server` and `aws-smithy-http-server-python` now depend on 0.7.0 of `lambda_http`. Failing to do so would cause `pokemon-service` to fail to compile due to an error at `lambda_http::run(handler)` in the main function of the `pokemon-service-lambda` binary: the trait `Service<lambda_http::http::Request<lambda_http::Body>>` is not implemented for `LambdaHandler<aws_smithy_http_server::routing::Router>` * Depend on lambda-http 0.7.1 This commit updates the version of `lambda_http` from 0.7.0 to 0.7.1 in the crates within the top-level `rust-runtime` workspace. These updates are needed to solve the issue described in awslabs/aws-lambda-rust-runtime#556 * Update CHANGELOG.next.toml * Address https://github.com/awslabs/smithy-rs/pull/1907\#pullrequestreview-1161609833 Co-authored-by: Saito <[email protected]> Co-authored-by: Zelda Hessler <[email protected]>

Saito added 2 commits October 25, 2022 15:59

ysaito1001 mentioned this pull request Oct 25, 2022

Remove cargo_audit_flags related to the chrono crate awslabs/aws-sdk-rust#646

Closed

Merge branch 'main' into ysaito/fix-cargo-audit-issue-on-chrono

fa835b2

ysaito1001 mentioned this pull request Oct 27, 2022

Bump patch version of lambda-http awslabs/aws-lambda-rust-runtime#556

Merged

2 tasks

Saito added 2 commits October 28, 2022 14:36

Depend on lambda-http 0.7.1

b158da0

This commit updates the version of `lambda_http` from 0.7.0 to 0.7.1 in the crates within the top-level `rust-runtime` workspace. These updates are needed to solve the issue described in awslabs/aws-lambda-rust-runtime#556

Merge branch 'main' into ysaito/fix-cargo-audit-issue-on-chrono

7fbadb7

Update CHANGELOG.next.toml

09f5331

ysaito1001 marked this pull request as ready for review October 28, 2022 20:18

ysaito1001 requested review from a team as code owners October 28, 2022 20:18

jdisanti approved these changes Oct 28, 2022

View reviewed changes

jdisanti added the needs-server-review label Oct 28, 2022

jjant approved these changes Oct 31, 2022

View reviewed changes

CHANGELOG.next.toml Outdated Show resolved Hide resolved

Saito added 2 commits October 31, 2022 14:10

Merge branch 'main' into ysaito/fix-cargo-audit-issue-on-chrono

ca43ee4

Address https://github.com/awslabs/smithy-rs/pull/1907\#pullrequestre…

eb68d7f

…view-1161609833

ysaito1001 enabled auto-merge (squash) October 31, 2022 19:31

ysaito1001 merged commit f0b7f55 into main Oct 31, 2022

ysaito1001 deleted the ysaito/fix-cargo-audit-issue-on-chrono branch October 31, 2022 20:06

Velfi removed the needs-server-review label Dec 2, 2022

ysaito1001 mentioned this pull request Dec 15, 2022

[Bug]: Fix cargo audit issue on chrono in Rust examples awsdocs/aws-doc-sdk-examples#4100

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fix cargo audit issue on chrono #1907

Fix cargo audit issue on chrono #1907

ysaito1001 commented Oct 25, 2022 •

edited

Loading

github-actions bot commented Oct 25, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 28, 2022

github-actions bot commented Oct 28, 2022

jdisanti left a comment

github-actions bot commented Oct 31, 2022

Fix cargo audit issue on chrono #1907

Fix cargo audit issue on chrono #1907

Conversation

ysaito1001 commented Oct 25, 2022 • edited Loading

Motivation and Context

Description

Testing

Checklist

github-actions bot commented Oct 25, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 26, 2022

github-actions bot commented Oct 28, 2022

github-actions bot commented Oct 28, 2022

jdisanti left a comment

Choose a reason for hiding this comment

github-actions bot commented Oct 31, 2022

ysaito1001 commented Oct 25, 2022 •

edited

Loading