cjw/Oxicloud
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Ignore RUSTSEC-2023-0071 in security audit

Browse Source 
RUSTSEC-2023-0071 (Marvin Attack) affects RSA private key operations.
This application uses HS256 for internal JWT signing and only performs
RSA public key verification (not private key operations) for OIDC/OAuth2.
This commit is contained in:
George Wu
2026-02-24 17:04:02 -08:00
parent 7786871d6c
commit 7e2e110cec
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yml
+4
View File
@@ -70,9 +70,13 @@ jobs:
runs-on: ubuntu-latest runs-on: ubuntu-latest
steps: steps:
- uses: actions/checkout@v6 - uses: actions/checkout@v6
# RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
# Not affected: This application uses HS256 for internal JWT signing and only performs
# RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
- uses: rustsec/audit-check@v2.0.0 - uses: rustsec/audit-check@v2.0.0
with: with:
token: ${{ secrets.GITHUB_TOKEN }} token: ${{ secrets.GITHUB_TOKEN }}
ignore: RUSTSEC-2023-0071
build: build:
name: Build Check name: Build Check