mirror of
https://github.com/storytold/wordcraft.git
synced 2026-11-02 16:30:05 -06:00
pkibiego
5c970f90bd
`crates/docx/src/xml.rs` parses untrusted document XML through `quick_xml::reader::NsReader`. In 0.38.4 that is RUSTSEC-2026-0195 (CVSS 7.5): the namespace resolver pushes a binding for every `xmlns` / `xmlns:*` declaration on a start tag into an unbounded `Vec`, with no limit on the number of declarations. None of the reader's existing caps bound that path - MAX_PART (256 MiB), MAX_TOTAL (512 MiB), MAX_ENTRIES, MAX_DEPTH and MAX_ELEMENTS bound part size, entry count, nesting and element count, not declarations per tag. Measured before this change, `wordcraft-cli convert` on a crafted .docx whose `word/document.xml` is one start tag with 21,845,333 `xmlns:a="u"` declarations: 508 KB on disk -> 262 MB decompressed (under MAX_PART) -> 1.19 GB peak RSS, exit 0: the document opened and converted without any warning. At the MAX_PART/MAX_TOTAL ceiling that is roughly 2.4 GB of resident memory from about a megabyte of download, i.e. an OOM kill with unsaved work open. Nothing panics, so the `Session::run` guard does not catch it. 0.41.0 caps namespace declarations per start tag at 256 (`DEFAULT_MAX_DECLARATIONS_PER_ELEMENT`, raisable through `NamespaceResolver::set_max_declarations_per_element`) and returns `NamespaceError::TooManyDeclarations` beyond it. The same fixture now fails in about a second with a clear error and no namespace allocation: wordcraft-cli: malformed XML: start tag declares more than 256 namespace bindings; raise the limit with NamespaceResolver::set_max_declarations_per_element Two API adaptations for 0.41 (0.x bumps are allowed to break): - `resolve_attribute` moved off `NsReader` on to the resolver: `r.resolve_attribute(key)` -> `r.resolver_mut().resolve_attribute(key)`. - `Attribute::unescape_value` is deprecated in favour of `normalized_value`, which also applies XML attribute-value normalization as the spec requires; attribute values in a Word part are UTF-8 here (UTF-16 parts are transcoded first). Regression test: `crates/docx/src/xml.rs::too_many_namespace_declarations_is_error` asserts a tag with 10,000 declarations is an error. It fails on 0.38.4 and passes on 0.41.0. This also clears the second quick-xml advisory, RUSTSEC-2026-0194 (quadratic duplicate-attribute scan). That one was not reachable here - the reader already passes `with_checks(false)` at xml.rs:257, and a 60,000-attribute tag parses in the same 65 ms as a 20,000-attribute one - but `cargo audit` is clean afterwards. Verified: `cargo xtask ci`; `cargo audit` (no vulnerabilities left, the two unmaintained-crate warnings are `krilla`'s `rustybuzz`/`ttf-parser` and are unrelated); 32 docx tests plus the malformed-input suite; and 21 crafted hostile documents through `wordcraft-cli convert` with zero panics before and after. One residual, unchanged by this commit: the fixture above still costs about 509 MB, because MAX_PART lets one part decompress to 256 MiB and every part is held in memory while the package is read. That is the existing, intended bound; what this commit removes is the namespace allocation on top of it.