Oxicloud/.cargo/audit.toml

[advisories]
ignore = [
    # paste unmaintained — transitive via azure_core 0.21.0 (latest available).
    # No direct security impact; no upgrade path exists.
    # keep warning "RUSTSEC-2024-0436",

    # rand 0.7.3 unsound — transitive via http-types → azure_core 0.21.0.
    # Only exploitable with a custom logger using rand::rng(); not applicable here.
    "RUSTSEC-2026-0097",

    # RUSTSEC-2023-0071 (Marvin Attack): rsa crate is a transitive dependency from jsonwebtoken.
    # Not affected: This application uses HS256 for internal JWT signing and only performs
    # RSA public key verification (not private key operations) for OIDC/OAuth2 tokens.
    "RUSTSEC-2023-0071",

    # rustls-webpki 0.101.7 — three advisories, all transitive via AWS SDK → rustls 0.21.12.
    # aws-sdk-s3 1.x (latest) has not yet migrated to rustls 0.23.x; no upgrade path available.
    # Severity: low — exploitation requires either a rogue CA or a MitM on AWS S3 infrastructure.
    #   RUSTSEC-2026-0104: DoS via panic in CRL parsing (only if CRLs are processed).
    #   RUSTSEC-2026-0098: URI name constraints ignored (requires CA misissuance).
    #   RUSTSEC-2026-0099: Wildcard name constraint bypass (requires CA misissuance).
    "RUSTSEC-2026-0104",
    "RUSTSEC-2026-0098",
    "RUSTSEC-2026-0099",

    # h2 0.3.27 — RUSTSEC-2026-0258 "unbounded empty DATA frames"
    # (GHSA-q83h-524g-xf6h). Transitive via aws-smithy-http-client 1.1.12
    # → hyper 0.14.32 → h2 0.3.27. The patched line is 0.4.16+, but hyper
    # 0.14's `h2 = "0.3"` requirement pins us to the 0.3.x branch which
    # will not receive a backport — real fix requires aws-smithy-http-client
    # to migrate to hyper 1.x (which our other h2 copy — 0.4.16, already
    # bumped — is on). The 0.4.x copy is fixed via `cargo update`; this
    # ignore covers only the 0.3.x chain.
    #
    # Severity: low (advisory's own classification). Attack is empty-DATA-
    # frame flooding by a malicious HTTP/2 peer → memory pressure or panic.
    # In this codebase h2 0.3.x runs strictly on the CLIENT side of AWS
    # SDK requests to S3 endpoints. Exploitation requires either
    # compromising AWS S3 (out-of-scope) or MitM with a valid TLS cert
    # for the configured S3 host (bigger problem than the DoS). No
    # data-integrity or auth impact; panic path contained by
    # request-level unwind.
    #
    # Un-ignore trigger: aws-smithy-http-client releases a version that
    # switches to hyper 1.x (checkable with `cargo tree -i h2@0.3` — the
    # command returns no rows once the chain is gone). Track upstream at
    # https://github.com/smithy-lang/smithy-rs/issues (search "hyper 1").
    "RUSTSEC-2026-0258",

    # instant unmaintained — transitive via azure_core 0.21.0 (latest available).
    # No direct security impact; no upgrade path exists.
    "RUSTSEC-2024-0384",

    # quick-xml 0.31.0 — transitive via azure_core 0.21.0 (unofficial SDK,
    # now archived). Our direct dep is already on 0.41.0; the 0.31 copy is
    # only reachable through the azure_storage_blobs chain, which parses
    # XML responses received from Azure Storage over TLS. Neither CVE is
    # exploitable without attacker-controlled XML, so the vector requires
    # MitM of the TLS channel to Azure (or a compromised storage
    # endpoint). Real fix is migrating to the official azure_core 1.0 /
    # azure_storage_blob 1.0 SDK — tracked separately.
    #   RUSTSEC-2026-0195: unbounded ns-declaration allocation → mem-DoS
    #   RUSTSEC-2026-0194: quadratic dup-attribute check → CPU-DoS
    "RUSTSEC-2026-0195",
    "RUSTSEC-2026-0194",

    # wasmtime 43.0.2 — "Stores can mix up type indices between engines"
    # (GHSA-hgjw-h833-99q9). Transitive via extism 1.30.0 (latest published;
    # extism `main` still pins wasmtime 43, no upgrade path). The advisory
    # has no patched 43.x — fix requires wasmtime >=46.0.2 or >=47.0.3, and
    # forcing that via [patch.crates-io] would break extism (three major
    # wasmtime API bumps between 43 and 46). Real fix waits on extism
    # upstream to migrate.
    #
    # Runtime exposure is zero in default deployments:
    #   - `plugins` is an OPT-IN build feature; default builds and the CI
    #     release binary don't link wasmtime at all.
    #   - Runtime activation additionally requires OXICLOUD_ENABLE_PLUGINS=true.
    #   - Plugin binaries are ADMIN-SUPPLIED, not attacker input.
    #   - The advisory's attack pattern is multi-Engine Store-sharing;
    #     OxiCloud's plugin runtime creates one fresh Plugin per invocation
    #     with its own Store (see infrastructure/services/plugins/runtime.rs).
    "RUSTSEC-2026-0222",

    # astral-tokio-tar 0.5.6 — tar extraction advisories, transitive via
    # testcontainers → testcontainers-modules, a DEV-dependency used only by
    # the `--cfg integration_tests` harness to spin up throwaway Postgres
    # containers. Never compiled into the production binary and never fed
    # attacker-controlled tar input — the only archives extracted are the
    # official Postgres images the test harness pulls. testcontainers 0.25.2
    # pins astral-tokio-tar to ^0.5, so the fixed 0.6.x is not reachable
    # without a testcontainers major bump (tracked separately).
    #   RUSTSEC-2026-0145 / -0112: PAX header desynchronization
    #   RUSTSEC-2026-0113: unpack_in symlink-following chmod
    #   RUSTSEC-2026-0066: insufficient PAX extension validation (low)
    "RUSTSEC-2026-0145",
    "RUSTSEC-2026-0112",
    "RUSTSEC-2026-0113",
    "RUSTSEC-2026-0066",
]