Repository navigation
Expand file tree
/
Copy pathdeny.toml
More file actions
95 lines (92 loc) · 5.18 KB
/
Copy pathdeny.toml
File metadata and controls
95 lines (92 loc) · 5.18 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
[licenses]
clarify = [
{ name = "near-chain", expression = "MIT OR Apache-2.0", license-files = [
] },
{ name = "stringmetrics", expression = "Apache-2.0", license-files = [
{ path = "LICENSE", hash = 0xc9663a1e },
] },
]
allow = [
"Apache-2.0",
"MIT",
"BSD-3-Clause",
"BSD-2-Clause",
"MPL-2.0",
"Zlib",
"Apache-2.0 WITH LLVM-exception",
"ISC",
"Unicode-3.0",
"CC0-1.0",
"CDLA-Permissive-2.0",
"CDDL-1.0",
]
[advisories]
unsound = "all"
ignore = [
"RUSTSEC-2022-0054", # wee_alloc is unmaintained
"RUSTSEC-2024-0436", # paste is unmaintained
"RUSTSEC-2024-0384", # instant is unmaintained
"RUSTSEC-2023-0089", # atomic-polyfill is unmaintained
# Pulled in by serde_yaml, which nearcore's near-parameters also depends on.
"RUSTSEC-2024-0449", # unsafe-libyaml is unmaintained
# TODO(#3732): remove once quick-xml dependency is >= 0.41.0
"RUSTSEC-2026-0194", # quadratic attribute duplicate-check
"RUSTSEC-2026-0195", # unbounded namespace-declaration allocation
# Both need wasmtime >= 46.0.3; the 45.x line nearcore pins has no
# patched release for either. Reachable only through near-vm-runner, which never
# shares a Store across Engines and does not depend on `wasmtime-wasi`.
"RUSTSEC-2026-0222", # wasmtime stores can mix up type indices between engines
"RUSTSEC-2026-0269", # wasmtime-wasi filesystem sandbox escape via trailing slashes
# Fixed in wasmtime >= 48.0.3, with no patched 45.x release. Affects only the component-model
# `Val` API; no crate in the workspace enables wasmtime's `component-model` feature.
"RUSTSEC-2026-0316", # wasmtime `Val` record lifting allocates beyond the fuel limit
# Fixed in wasmtime >= 48.0.4, with no patched 45.x release. Affects only the component-model
# async API; no crate in the workspace enables wasmtime's `component-model` feature.
"RUSTSEC-2026-0327", # wasmtime component async-lifted callback result count unvalidated
# Fixed in wasmtime >= 48.0.6, with no patched 45.x release. The workspace builds wasmtime
# without its `gc`, `async` and `component-model` features, and near-vm-runner's preparation
# step rejects the GC reference types a guest needs to build the type chain in 0359.
"RUSTSEC-2026-0359", # wasmtime stack overflow dropping a long chain of recursive types
"RUSTSEC-2026-0362", # wasmtime may not enforce the async-entrypoint requirement
"RUSTSEC-2026-0363", # wasmtime component-model handle tables are charged to no limit
# Fixed in wasmtime >= 48.0.7, with no patched 45.x release. Affects only the Cranelift
# aarch64 backend; release and CI builds target x86_64, where the miscompiled lowering
# is never emitted.
"RUSTSEC-2026-0379", # wasmtime aarch64 jumps to incorrect target on large `br_table`
# TODO(#4839): remove once cargo can resolve zip >= 9.0.0.
# zip comes only from nearcore's near-rosetta-rpc via utoipa-swagger-ui, whose build script
# never calls the vulnerable `extract` APIs: it writes entries as plain files from a pinned
# Swagger UI release archive.
"RUSTSEC-2026-0367", # zip extraction preserves SUID/SGID bits
"RUSTSEC-2026-0368", # zip extraction creates symlinks pointing outside the destination
"RUSTSEC-2026-0369", # zip extraction applies Unix permissions through symlinks
# TODO(#4423): remove once cargo can resolve rustls >= 0.23.45.
# Fixed in rustls >= 0.23.45, which requires aws-lc-rs ^1.18; nearcore 2.14.0-rc.2 and
# near-crypto 0.37.4 pin it to =1.16.2, so the fix cannot be resolved until they move. The
# handshake transcript stays authenticated: the flaw only lets a peer send handshake
# messages that should be encrypted in plaintext without rustls rejecting them.
"RUSTSEC-2026-0285", # rustls accepts TLS 1.3 handshake messages across encryption levels
# TODO(#4423): remove once cargo can resolve rustls >= 0.23.46, blocked by the same pin.
# No crate enables rustls's `brotli` feature, the workspace has no custom
# `ClientSessionStore`, and our own TLS configs use the ring provider, which offers no
# post-quantum key exchange to downgrade
"RUSTSEC-2026-0346", # rustls client session values expose TLS secrets through `Debug`
"RUSTSEC-2026-0348", # rustls Brotli certificate decompression can allocate up to 1 GiB
"RUSTSEC-2026-0349", # rustls ServerHello can downgrade later handshakes to classical kx
# TODO(#4423): remove once cargo can resolve rustls-webpki >= 0.103.16, blocked by the same pin.
# No root we trust chains to the distrusted keys: webpki-roots and webpki-root-certs >= 1.0.10
# drop emSign ECC Root CA - G3, and so do the Debian trust stores the images ship:
# ca-certificates 20250419~deb12u2 (bookworm) and 20250419+deb13u1 (trixie) also drop
# Comodo AAA Services root, the only other root that cross-signed those intermediates.
"RUSTSEC-2026-0382", # rustls-webpki accepts paths through distrusted emSign intermediates
# Fixed in lru >= 0.18.2, which our own dependency already uses; the older copies come from
# nearcore, through reed-solomon-erasure, and from the VM behind near-sdk's unit tests
"RUSTSEC-2026-0253", # lru cache is not panic-safe when removing an entry
]
[bans]
multiple-versions = "allow"
[sources]
unknown-git = "deny"
allow-git = [
"https://github.com/near/nearcore",
]