SemianiakaVY/openpencil
1
0
Fork 0
Code Issues Pull requests Actions 1 Packages Projects Releases Wiki Activity

chore(ci): ignore quick-xml dos advisories pinned by wayland/zbus

Browse source 
RUSTSEC-2026-0194 / -0195 flag quick-xml < 0.41 for XML-parsing DoS.
quick-xml only reaches this tree through wayland-scanner (build-time
parse of the bundled wayland protocol XML) and zbus_xml/ashpd (local
D-Bus introspection replies) — never attacker-controlled input — and
both pin quick-xml requirements below 0.41, so there is no upgrade
path yet. Documented ignore, same pattern as the backoff/ttf-parser
entries; revisit when the wayland/zbus stacks bump quick-xml.
This commit is contained in:
Kayshen-X 2026-07-03 00:08:25 +08:00
parent 7607f061ac
commit c0e4f654d2
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
deny.toml
View file

@ -50,6 +50,15 @@ ignore = [
# maintained replacement, and the advisory is informational (no
# vulnerability). Revisit when the upstream font crates migrate off it.
"RUSTSEC-2026-0192",
# quick-xml < 0.41 DoS advisories (quadratic duplicate-attribute check /
# unbounded NsReader namespace allocation). quick-xml reaches this tree
# only through the Linux windowing + D-Bus stacks — wayland-scanner
# (parses the BUNDLED wayland protocol XML at build time) and
# zbus_xml/ashpd (parse local D-Bus introspection replies) — never
# attacker-controlled XML. No upgrade path until wayland-scanner /
# zbus_xml bump their quick-xml requirement to >= 0.41.
"RUSTSEC-2026-0194",
"RUSTSEC-2026-0195",
]
[bans]