mirror of
https://github.com/storytold/gridcraft.git
synced 2026-10-26 11:46:49 -06:00
pkibiego
2f078962a0
The ODS and XLSB readers parse untrusted package metadata and content through
`quick_xml::NsReader`. In 0.38.4 that is RUSTSEC-2026-0195 (CVSS 7.5): the namespace
resolver pushes a binding for every `xmlns` / `xmlns:*` declaration on a start tag, with
no cap on how many there are, and `NsReader::read_event` reaches that path - not only
`read_resolved_event`.
None of our caps bound it. MAX_PART (512 MiB), MAX_TOTAL (1 GiB), MAX_ENTRIES,
MAX_CELLS, MAX_TEXT and MAX_DEPTH bound part size, entry count, cells, text and nesting,
never declarations per tag.
Measured with `gridcraft-cli info` on crafted .ods files, before this change:
754 B, 0 declarations -> 8.6 MB, exit 0
24 KB, 1,000,000 -> 52.6 MB, exit 0
187 KB, 8,000,000 -> 367.8 MB, exit 0
770 KB, 33,000,000 -> 1.46 GB, exit 0
About 45 bytes of resident memory per declaration, roughly 1,900x the file size, and no
error at all. At MAX_PART a ~1 MB file reaches ~1.9 GB, and every part is held in memory
while the package is read. Both readers share the path, so a downloaded .ods or .xlsb
was enough. Nothing panicked, so `Session::execute` never saw it.
0.41.0 caps declarations per start tag at 256 (DEFAULT_MAX_DECLARATIONS_PER_ELEMENT,
raisable through NamespaceResolver::set_max_declarations_per_element) and returns
`NamespaceError::TooManyDeclarations` beyond it. The same fixtures after:
754 B -> 8.6 MB, ok 24 KB -> 19 MB, error
187 KB -> 101.8 MB, error 770 KB -> 397 MB, error
with "start tag declares more than 256 namespace bindings". The residual peak is the
part itself: MAX_PART still lets one part decompress to 256 MiB, the existing intended
bound.
API changes for 0.41 (0.x bumps may break; all four are in the xlsx crate):
- `resolve_element` and `resolve_attribute` moved off `NsReader` on to the resolver:
`reader.resolver_mut().resolve_element(..)`. `attr` and `tag` in ods.rs take
`&mut NsReader` for that.
- `Attribute::unescape_value` is deprecated in favour of `normalized_value`, which also
applies the attribute-value normalization the XML specification requires.
- `BytesText::xml_content` now takes the document's XML version.
This also clears RUSTSEC-2026-0194, the quadratic duplicate-attribute check. xml.rs
already passed `with_checks(false)`, but ods.rs and xlsb.rs used the checked iterator, so
they were on the quadratic path as well.
Regression test: `ods_tests::ods_namespace_declaration_bomb_is_rejected` asserts that a
tag with thousands of declarations is an error and that a document with a handful still
reads. It fails on 0.38.4 (the tag is accepted) and passes on 0.41.0.
Verified: `cargo xtask ci`; the full xlsx suite (80 tests) plus the malformed-input
tests; and the four measurements above, before and after, with no panics either way.
69 lines
1.9 KiB
TOML
69 lines
1.9 KiB
TOML
[workspace]
|
|
resolver = "3"
|
|
members = ["crates/*", "apps/*", "xtask"]
|
|
default-members = ["crates/*", "apps/gridcraft", "apps/gridcraft-cli", "xtask"]
|
|
|
|
[workspace.package]
|
|
version = "0.5.0"
|
|
edition = "2024"
|
|
license = "MIT OR Apache-2.0"
|
|
rust-version = "1.90"
|
|
repository = "https://github.com/storytold/gridcraft"
|
|
|
|
[workspace.dependencies]
|
|
# internal
|
|
gridcraft-core = { path = "crates/core" }
|
|
gridcraft-numfmt = { path = "crates/numfmt" }
|
|
gridcraft-formula = { path = "crates/formula" }
|
|
gridcraft-functions = { path = "crates/functions" }
|
|
gridcraft-model = { path = "crates/model" }
|
|
gridcraft-calc = { path = "crates/calc" }
|
|
gridcraft-xlsx = { path = "crates/xlsx" }
|
|
gridcraft-chart = { path = "crates/chart" }
|
|
gridcraft-engine = { path = "crates/engine" }
|
|
gridcraft-ui-egui = { path = "crates/ui-egui" }
|
|
gridcraft-mcp = { path = "crates/mcp" }
|
|
gridcraft-pdf = { path = "crates/pdf" }
|
|
|
|
# foundation
|
|
thiserror = "2"
|
|
serde = { version = "1", features = ["derive", "rc"] }
|
|
serde_json = { version = "1", features = ["float_roundtrip"] }
|
|
log = "0.4"
|
|
rayon = "1"
|
|
regex = { version = "1", default-features = false, features = ["std", "unicode", "perf"] }
|
|
quick-xml = "0.41"
|
|
zip = { version = "3", default-features = false, features = ["deflate"] }
|
|
image = { version = "0.25", default-features = false, features = ["png", "jpeg"] }
|
|
|
|
# ui
|
|
egui = "0.36"
|
|
egui_extras = { version = "0.36", default-features = false }
|
|
eframe = { version = "0.36", default-features = false }
|
|
egui_kittest = "0.36"
|
|
rfd = "0.17"
|
|
arboard = { version = "3.6", default-features = false }
|
|
# The desktop's preferred language, for the first-run interface language (native only).
|
|
sys-locale = "0.3"
|
|
|
|
[workspace.lints.rust]
|
|
unsafe_code = "forbid"
|
|
|
|
[workspace.lints.clippy]
|
|
dbg_macro = "warn"
|
|
todo = "warn"
|
|
too_many_arguments = "allow"
|
|
type_complexity = "allow"
|
|
|
|
[profile.dev.package."*"]
|
|
opt-level = 2
|
|
|
|
[profile.dev]
|
|
opt-level = 1
|
|
|
|
[profile.release]
|
|
opt-level = 3
|
|
lto = "thin"
|
|
codegen-units = 16
|
|
debug = 0
|