-
Notifications
You must be signed in to change notification settings - Fork 3k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Update Rust crate sqlx to 0.8 [SECURITY] #16791
Conversation
|
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
This PR contains the following updates:
0.7
->0.8
0.7
->0.8
GitHub Vulnerability Alerts
GHSA-xmrp-424f-vfpx
The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord:
Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow,
causing the server to interpret the rest of the string as binary protocol commands or other data.
It appears SQLx does perform truncating casts in a way that could be problematic,
for example: https://github.com/launchbadge/sqlx/blob/6f2905695b9606b5f51b40ce10af63ac9e696bb8/sqlx-postgres/src/arguments.rs#L163
This code has existed essentially since the beginning,
so it is reasonable to assume that all published versions
<= 0.8.0
are affected.Mitigation
As always, you should make sure your application is validating untrustworthy user input.
Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB.
Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.
Encode::size_hint()
can be used for sanity checks, but do not assume that the size returned is accurate.
For example, the
Json<T>
andText<T>
adapters have no reasonable way to predict or estimate the final encoded size,so they just return
size_of::<T>()
instead.For web application backends, consider adding some middleware that limits the size of request bodies by default.
Resolution
Work has started on a branch to add
#[deny]
directives for the following Clippy lints:cast_possible_truncation
cast_possible_wrap
cast_sign_loss
and to manually audit the code that they flag.
A fix is expected to be included in the
0.8.1
release (still WIP as of writing).Release Notes
launchbadge/sqlx (sqlx)
v0.8.1
Compare Source
16 pull requests were merged this release cycle.
This release contains a fix for RUSTSEC-2024-0363.
Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated:
#3440 (comment)
MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.
Added
MySqlConnectOptions::no_engine_substitution()
[[@kolinfluence]]MySqlConnectOptions::no_engine_subsitution()
(oops) in favor of the correctly spelled version.Changed
spec_error
module [[@abonander]]Use at your own risk.
libsqlite3-sys=0.30.1
to support sqlite 3.46 [[@CommanderStorm]]ring
(the existing implementation),and
aws-lc-rs
which has optional FIPS certification.runtime-tokio-rustls
,runtime-async-std-rustls
,tls-rustls
)enable the
ring
provider of RusTLS to match the existing behavior so this should not be a breaking change.tls-rustls-aws-lc-rs
feature to use theaws-lc-rs
provider.runtime-tokio-rustls
orruntime-async-std-rustls
,this will necessitate switching to the appropriate non-legacy runtime feature:
runtime-tokio
orruntime-async-std
Fixed
sqlx::Type
[[@alu]]node12
inSQLx
action [[@hamirmahal]]v0.18.1
to avoid yankedv0.14.3
[[@CommanderStorm]]v0.8.0
Compare Source
70 pull requests were merged this release cycle.
#2697 was merged the same day as release 0.7.4 and so was missed by the automatic CHANGELOG generation.
Breaking
#[sqlx::test]
usages are applied in the correct order now.MigrateError
.-- no-transaction
to the beginning.Migration
i64
as intermediate when decoding [[@abonander]]#[derive(sqlx::Type)]
in Postgres [[@abonander]]#[sqlx(no_pg_array)]
where conflicts occur.PgTypeInfo::with_name()
infers types that start with_
to be arrays of the un-prefixed type. Wrap type names in quotes to bypass this behavior.FromRow
, returnError::ColumnDecode
forTryFrom
errors [[@abonander]]#[sqlx(try_from = "T")]
now returnError::ColumnDecode
instead ofError::ColumnNotFound
.#[sqlx(default)]
on an individual field or the struct itself would have previously suppressed the error.This doesn't seem like good behavior as it could result in some potentially very difficult bugs.
From
and apply the default explicitly.#[sqlx(rename)]
and#[sqlx(rename_all)]
to match the expected behavior (rename
wins).ConnectOptions::to_url_lossy()
to match what parsing expects.Added
MySqlTime
, auditmysql::types
for panics [[@abonander]]NonZero*
scalar types [[@AlphaKeks]]Changed
Send
trait bound from argument binding [[@bobozaur]]libsqlite3-sys
are not considered breaking changes as per our semver guarantees.MySqlConnection
to reduce sizes of futures [[@stepantubanov]]sqlx migrate add ...
[[@CommanderStorm]]Fixed
ConnectionHandleRaw
type [[@abonander]]docker compose
instead ofdocker-compose
[[@abonander]]path
ownership problems when usingsqlx_macros_unstable
[[@lily-mosquitoes]]sqlx_postgres::any
[[@Zarathustra2]]migrate
error message. (#3275) [[@nk9]]persistent
query setting when preparing queries with theAny
driver [[@etorreborre]]select_input_type!()
being unhygenic [[@CommanderStorm]]M
orC
Notice fields are not UTF-8 [[@YgorSouza]]json
-feature should activatesqlx-postgres?/json
as well [[@CommanderStorm]]clock
andstd
features ofworkspace.dependencies.chrono
.v0.7.4
Compare Source
38 pull requests were merged this release cycle.
This is officially the last release of the 0.7.x release cycle.
As of this release, development of 0.8.0 has begun on
main
and only high-priority bugfixes may be backported.Added
to_url_lossy
to connect options [[@lily-mosquitoes]]query!
for cargo-free systems [[@kshramt]]raw_sql
API [[@abonander]]prepared statement interfaces
query*()
andquery!()
.query*()
functions.execute_many()
andfetch_many()
on interfaces that use prepared statements.interface is the only way to execute SQL. All other database flavors forbid multiple statements in
one prepared statement string as an extra defense against SQL injection.
raw_sql
API retains this functionality because it explicitly does not use prepared statements.Raw or text-mode query interfaces generally allow multiple statements in one query string, and this is
supported by all current databases. Due to their nature, however, one cannot use bind parameters with them.
Changed
create_new
instead ofatomic-file-write
[[@mattfbacon]]PgConnectOptions
[[@Fyko]]#[sqlx::test]
[[@ciffelia]]Fixed
sqlx::migrate::Migrator
.migrate!()
.v0.7.3
38 pull requests were merged this release cycle.
Added
fixtures_path
in sqlx::test args [[@ripa1995]]fn PgConnectOptions::get_host(&self)
[[@boris-lok]]FromRow
for the unit type [[@nanoqsh]]MySqlConnectOptions::get_database()
[[@shiftrightonce]]Text
adapter [[@abonander]]Changed
BOOLEAN
and the query macros [[@abonander]]NUMERIC
support [[@abonander]]libsqlite3-sys
to 0.27.0libsqlite3-sys
is considered semver-exempt;see the release notes for 0.7.0 below for details.
Fixed
rust_decimal::Decimal
for high-precision values [[@abonander]]sqlx migrate add
help text [[@cryeprecision]]try_stream!()
[[@abonander]]cargo build
[[@nyurik]]AtomicUsize
for thread IDs [[@abonander]]Configuration
📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
Release Notes: