RUSTSEC-2021-0019 - Multiple soundness issues, maintenance status

[martin-t]

There's an advisory out for XCB. The individual issues appear to be reported here but i don't see any response from you on any of them:

• https://github.com/rtbo/rust-xcb/issues/78
• https://github.com/rtbo/rust-xcb/issues/94
• https://github.com/rtbo/rust-xcb/issues/95
• https://github.com/rtbo/rust-xcb/issues/96

The issue with details also says XCB is unmaintained but i can see commits on a branch from a week ago. Are you still maintaining this crate? If so, would you, please, look at those issues? XCB is (transitively) a dependency of a lot of crates such as egui, conrod, alacritty and rg3d, though i don't know how many use the relevant functions.

I understand maintaining a popular crate is a lot of work and often not even interesting work. Would you be open to spreading the responsibility around a little? Perhaps you could create a Github organization with maintainers of some of these big crates as members if they would be interested. I also usually suggest using Rust Bus.

Finally, since this is a security issue, would you pin it so it receives more attention?

---

Edit(2021-11-07): One more advisory:

• https://github.com/rtbo/rust-xcb/issues/93
  This is actually older but our CI only picked it up recently fsr. Adding it here so it's all in one place.

[rtbo]

Hi. Thanks for this. Indeed over the last few years I couldn't support rust-xcb the way it deserved. There was a call for mainteners in the Readme that I have removed since as I am now able to support actively.
Regarding the safety and soundness issues, these are being dealt with in the PR I'm working on #105 . But it comes with an important API change (basically a complete rewrite of the library) so maybe not ideal to everybody but I think necessary (at least for the soundness aspect).
I'm totally open to spread the maintenance responsibility.
I'm not familiar with the links you pointed and will look at them.

[rtbo]

rust-xcb is now part of the new organization rust-x-bindings.
I plan to move there also toy_xcb and xkbcommon-rs

[rtbo]

v1.0.0-beta.0 is released to crates.io. See branch v1.0-dev.
Any comment in the new API, please don't hesitate to voice. Either in this issue or in another one.
You can get a good grasp on the new API from the ReadMe (in the v1.0-dev branch), from the examples, and from the documentation.

[rtbo]

v1.0.0 is released.