Actix-web: RustSec advisory?

[tarcieri]

I'm somewhat reluctant to ask this, but it seems like the previously diagnosed unsound usage of unsafe may deserve a RustSec advisory.

I'm curious to hear opinions on whether this particular vulnerability is security-critical, and if so, get assistance on how we should file it.

[Dowwie]

Where in this RustSec Vulnerability Criteria would this qualify? Is it unequivocally considered "Memory Corruption"? Reporting seems prudent if so. Even if there is ambiguity, it still may be worth at least reporting a warning advisory for the effected versions.

@actix/contributors thoughts?

[mitsuhiko]

Seems reasonable. Better safe than sorry.

[kaushalyap]

It's worth making things more secure even with some performance sacrifice in order for actix-web to reach wide adoption.
better security -> wider adoption (bigger community) -> better quality (performance, security, reliability) -> :smiley:

[tarcieri]

I think we can close this issue as at least being tracked at https://github.com/RustSec/advisory-db/issues/294. Otherwise it seems like a number of issues have been fixed and filed already, so I think we're good here.

[Shnatsel]

I've filed advisories for issues that were fixed in the 3.0 release:

https://rustsec.org/advisories/RUSTSEC-2020-0045.html
https://rustsec.org/advisories/RUSTSEC-2020-0046.html
https://rustsec.org/advisories/RUSTSEC-2020-0048.html
https://rustsec.org/advisories/RUSTSEC-2020-0049.html

And also one for very old actix from 2018:
https://rustsec.org/advisories/RUSTSEC-2018-0019.html
Nobody should be using that by now, but better safe than sorry.

If I've missed anything, or if I got something wrong, please let me know.