Skip to content

Commit 4a0724b

Browse files
committed
Address security issues involving quote API
Ref: GHSA-r7qv-8r2h-pg27 - Deprecate quote APIs in favor of `try_` equivalents that complain about nul bytes. - Also add a builder API, which allows re-enabling nul bytes without using the deprecated interface, and in the future can allow other things (as discussed in quoting_warning). - Add documentation about various security risks that remain, particularly with interactive shells. - Add fuzzers that actually verify round-trippability of the quote APIs against various shells, Python `shlex`, and C `wordexp`. - These are separate crates (as opposed to just being different files under `fuzz/fuzz_targets`) because they have different dependencies and build steps, and I don't want to agglomerate them all together. I've put them in the same workspace at least. - Also, check in Cargo.lock for the fuzzers, since they are binaries. - Add explicit MSRV of 1.46.0. This crate didn't previously have an explicit MSRV, but `cargo msrv` tells me that shlex 1.2.0 works down to Rust 1.36.0. Since this is a security fix, ideally the MSRV wouldn't be bumped at all, but that's not really feasible since the new API uses `#[non_exhaustive]`, which was unstable in Rust 1.36.0. In case anyone is stuck on old Rust versions, I separately released a shlex 1.2.1 that only has the fix for `{`/`}`/`\xa0`, without the API changes. However, even for the full release I'd still like to keep the MSRV reasonably old. I picked 1.46.0 because it's the first version that wouldn't require completely redoing the `const fn` bitmask. - Add more authors to Cargo.toml based on Git commits.
1 parent 4c53044 commit 4a0724b

22 files changed

+2179
-78
lines changed

.gitignore

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,8 @@
1-
/target/
2-
Cargo.lock
1+
nocommit/
2+
target/
3+
artifacts/
4+
corpus/
5+
/Cargo.lock
36
**/*.rs.bk
7+
.*.sw?
8+
.sw?

Cargo.toml

+7-2
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,13 @@
11
[package]
22
name = "shlex"
3-
version = "1.2.1"
3+
version = "1.3.0"
44
authors = [
55
"comex <[email protected]>",
6-
6+
"Fenhl <[email protected]>",
7+
"Adrian Taylor <[email protected]>",
8+
"Alex Touchet <[email protected]>",
9+
"Daniel Parks <[email protected]>",
10+
"Garrett Berg <[email protected]>",
711
]
812
license = "MIT OR Apache-2.0"
913
repository = "https://github.com/comex/rust-shlex"
@@ -12,6 +16,7 @@ categories = [
1216
"command-line-interface",
1317
"parser-implementations"
1418
]
19+
rust-version = "1.46.0"
1520

1621
[features]
1722
std = []

0 commit comments

Comments
 (0)