Update Rust crate sqlx to 0.8 [SECURITY] #16791
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
|
cla-bot
bot
added
the
cla-signed
|
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
0.7->0.80.7->0.8GitHub Vulnerability Alerts
GHSA-xmrp-424f-vfpx
The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord:
Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow,
causing the server to interpret the rest of the string as binary protocol commands or other data.
It appears SQLx does perform truncating casts in a way that could be problematic,
for example: https://github.com/launchbadge/sqlx/blob/6f2905695b9606b5f51b40ce10af63ac9e696bb8/sqlx-postgres/src/arguments.rs#L163
This code has existed essentially since the beginning,
so it is reasonable to assume that all published versions
<= 0.8.0are affected.Mitigation
As always, you should make sure your application is validating untrustworthy user input.
Reject any input over 4 GiB, or any input that could encode to a string longer than 4 GiB.
Dynamically built queries are also potentially problematic if it pushes the message size over this 4 GiB bound.
Encode::size_hint()can be used for sanity checks, but do not assume that the size returned is accurate.
For example, the
Json<T>andText<T>adapters have no reasonable way to predict or estimate the final encoded size,so they just return
size_of::<T>()instead.For web application backends, consider adding some middleware that limits the size of request bodies by default.
Resolution
Work has started on a branch to add
#[deny]directives for the following Clippy lints:cast_possible_truncationcast_possible_wrapcast_sign_lossand to manually audit the code that they flag.
A fix is expected to be included in the
0.8.1release (still WIP as of writing).Release Notes
launchbadge/sqlx (sqlx)
v0.8.1Compare Source
16 pull requests were merged this release cycle.
This release contains a fix for RUSTSEC-2024-0363.
Postgres users are advised to upgrade ASAP as a possible exploit has been demonstrated:
#3440 (comment)
MySQL and SQLite do not appear to be exploitable, but upgrading is recommended nonetheless.
Added
MySqlConnectOptions::no_engine_substitution()[[@kolinfluence]]MySqlConnectOptions::no_engine_subsitution()(oops) in favor of the correctly spelled version.Changed
spec_errormodule [[@abonander]]Use at your own risk.
libsqlite3-sys=0.30.1to support sqlite 3.46 [[@CommanderStorm]]ring(the existing implementation),and
aws-lc-rswhich has optional FIPS certification.runtime-tokio-rustls,runtime-async-std-rustls,tls-rustls)enable the
ringprovider of RusTLS to match the existing behavior so this should not be a breaking change.tls-rustls-aws-lc-rsfeature to use theaws-lc-rsprovider.runtime-tokio-rustlsorruntime-async-std-rustls,this will necessitate switching to the appropriate non-legacy runtime feature:
runtime-tokioorruntime-async-stdFixed
sqlx::Type[[@alu]]node12inSQLxaction [[@hamirmahal]]v0.18.1to avoid yankedv0.14.3[[@CommanderStorm]]v0.8.0Compare Source
70 pull requests were merged this release cycle.
#2697 was merged the same day as release 0.7.4 and so was missed by the automatic CHANGELOG generation.
Breaking
#[sqlx::test]usages are applied in the correct order now.MigrateError.-- no-transactionto the beginning.Migrationi64as intermediate when decoding [[@abonander]]#[derive(sqlx::Type)]in Postgres [[@abonander]]#[sqlx(no_pg_array)]where conflicts occur.PgTypeInfo::with_name()infers types that start with_to be arrays of the un-prefixed type. Wrap type names in quotes to bypass this behavior.FromRow, returnError::ColumnDecodeforTryFromerrors [[@abonander]]#[sqlx(try_from = "T")]now returnError::ColumnDecodeinstead ofError::ColumnNotFound.#[sqlx(default)]on an individual field or the struct itself would have previously suppressed the error.This doesn't seem like good behavior as it could result in some potentially very difficult bugs.
Fromand apply the default explicitly.#[sqlx(rename)]and#[sqlx(rename_all)]to match the expected behavior (renamewins).ConnectOptions::to_url_lossy()to match what parsing expects.Added
MySqlTime, auditmysql::typesfor panics [[@abonander]]NonZero*scalar types [[@AlphaKeks]]Changed
Sendtrait bound from argument binding [[@bobozaur]]libsqlite3-sysare not considered breaking changes as per our semver guarantees.MySqlConnectionto reduce sizes of futures [[@stepantubanov]]sqlx migrate add ...[[@CommanderStorm]]Fixed
ConnectionHandleRawtype [[@abonander]]docker composeinstead ofdocker-compose[[@abonander]]pathownership problems when usingsqlx_macros_unstable[[@lily-mosquitoes]]sqlx_postgres::any[[@Zarathustra2]]migrateerror message. (#3275) [[@nk9]]persistentquery setting when preparing queries with theAnydriver [[@etorreborre]]select_input_type!()being unhygenic [[@CommanderStorm]]MorCNotice fields are not UTF-8 [[@YgorSouza]]json-feature should activatesqlx-postgres?/jsonas well [[@CommanderStorm]]clockandstdfeatures ofworkspace.dependencies.chrono.v0.7.4Compare Source
38 pull requests were merged this release cycle.
This is officially the last release of the 0.7.x release cycle.
As of this release, development of 0.8.0 has begun on
mainand only high-priority bugfixes may be backported.Added
to_url_lossyto connect options [[@lily-mosquitoes]]query!for cargo-free systems [[@kshramt]]raw_sqlAPI [[@abonander]]prepared statement interfaces
query*()andquery!().query*()functions.execute_many()andfetch_many()on interfaces that use prepared statements.interface is the only way to execute SQL. All other database flavors forbid multiple statements in
one prepared statement string as an extra defense against SQL injection.
raw_sqlAPI retains this functionality because it explicitly does not use prepared statements.Raw or text-mode query interfaces generally allow multiple statements in one query string, and this is
supported by all current databases. Due to their nature, however, one cannot use bind parameters with them.
Changed
create_newinstead ofatomic-file-write[[@mattfbacon]]PgConnectOptions[[@Fyko]]#[sqlx::test][[@ciffelia]]Fixed
sqlx::migrate::Migrator.migrate!().v0.7.338 pull requests were merged this release cycle.
Added
fixtures_pathin sqlx::test args [[@ripa1995]]fn PgConnectOptions::get_host(&self)[[@boris-lok]]FromRowfor the unit type [[@nanoqsh]]MySqlConnectOptions::get_database()[[@shiftrightonce]]Textadapter [[@abonander]]Changed
BOOLEANand the query macros [[@abonander]]NUMERICsupport [[@abonander]]libsqlite3-systo 0.27.0libsqlite3-sysis considered semver-exempt;see the release notes for 0.7.0 below for details.
Fixed
rust_decimal::Decimalfor high-precision values [[@abonander]]sqlx migrate addhelp text [[@cryeprecision]]try_stream!()[[@abonander]]cargo build[[@nyurik]]AtomicUsizefor thread IDs [[@abonander]]Configuration
📅 Schedule: Branch creation - "" in timezone America/New_York, Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about these updates again.
Release Notes: