2052161 - Crate depends on a vulnerable version of quick-xml.

Status: RESOLVED FIXED

(Testing :: Mozbase Rust, task)

Description

[Sylvestre Ledru [:Sylvestre]]

The cargo-audit lint fails because Cargo.lock pins quick-xml 0.37.5, flagged by two RustSec advisories:

• RUSTSEC-2026-0194 - quadratic runtime when checking a start tag for duplicate attribute names (DoS).
• RUSTSEC-2026-0195 - unbounded namespace-declaration allocation in NsReader (memory-exhaustion DoS).

Both are fixed in quick-xml >= 0.41.0. quick-xml is pulled in transitively via mozrunner -> plist. The latest plist (1.9.0) still depends on quick-xml 0.39.x, so we cannot upgrade past the vulnerable range yet.

In the meantime, add an exclude-error entry in tools/lint/cargo-audit.yml to keep CI green, mirroring the existing time / self_cell exclusions. Revisit once plist upstream bumps to quick-xml >= 0.41.0.

example:
https://treeherder.mozilla.org/jobs?repo=try&revision=f4b8f23719c64aa6a6859f65cee32bcb2c0521f5&selectedTaskRun=coSjXcS-Q4-HxBqxEHYdRw.0

Comment 1

[Henrik Skupin [:whimboo][⌚️UTC+2]]

https://github.com/ebarnard/rust-plist/pull/191 handles the version bump for quick-xml in plist. Lets hope they are fast to solve it. Would be good to have a fix as well for the upcoming geckodriver 0.37.1 bugfix release.

Comment 2

[Sylvestre Ledru [:Sylvestre]]

Attachment: Bug 2052161 - Exclude quick-xml from cargo-audit until plist upgrades past the vulnerable range. r=#linter-reviewers

Comment 3

[Pulsebot]

Pushed by [e-mail]:
https://github.com/mozilla-firefox/firefox/commit/d08e46fcadb0
https://hg.mozilla.org/integration/autoland/rev/f660a451c6dc
Exclude quick-xml from cargo-audit until plist upgrades past the vulnerable range. r=emilio

Comment 4

[Henrik Skupin [:whimboo][⌚️UTC+2]]

Bug 2052142 will be used for the actual version bump.

Comment 5

[Serban Stanca [:SerbanS]]

https://hg.mozilla.org/mozilla-central/rev/f660a451c6dc

Comment 6

[Landry Breuil (:gaston)]

can this eventually get backported to beta ? apparently it's blocking other backports like https://phabricator.services.mozilla.com/D310041#10764659 ...

Comment 7

[Sylvestre Ledru [:Sylvestre]]

Attachment: Bug 2052161 - Exclude quick-xml from cargo-audit until plist upgrades past the vulnerable range.

Original Revision: https://phabricator.services.mozilla.com/D310042

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Attachment: Bug 2052161 - Exclude quick-xml from cargo-audit until plist upgrades past the vulnerable range.

Original Revision: https://phabricator.services.mozilla.com/D310042

Comment 9

[Phabricator Automation]

firefox-beta Uplift Approval Request

• User impact if declined/Reason for urgency: Just ignoring/silent warning in the CI.
  doesn't go into our product
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: just ignore a warning
• String changes made/needed?: no
• Is Android affected?: no

Comment 10

[Phabricator Automation]

firefox-release Uplift Approval Request

• User impact if declined/Reason for urgency: Just ignoring/silent warning in the CI.
  doesn't go into our product
• Code covered by automated testing?: yes
• Fix verified in Nightly?: yes
• Needs manual QE testing?: no
• Steps to reproduce for manual QE testing:
• Risk associated with taking this patch: low
• Explanation of risk level: just ignore a warning
• String changes made/needed?: no
• Is Android affected?: no

Comment 11

[Sylvestre Ledru [:Sylvestre]]

Attachment: Bug 2052161 - Exclude quick-xml from cargo-audit until plist upgrades past the vulnerable range.

Original Revision: https://phabricator.services.mozilla.com/D310042

Comment 12

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/2f420e7b95ae
https://hg.mozilla.org/releases/mozilla-beta/rev/5930b31e7acd

Comment 13

[Pulsebot]

https://github.com/mozilla-firefox/firefox/commit/1ac9288bed20
https://hg.mozilla.org/releases/mozilla-release/rev/6efdb0a96f73