From c0e4f654d21c91ac67f57624813d2fd0935d5a6f Mon Sep 17 00:00:00 2001 From: Kayshen-X Date: Fri, 3 Jul 2026 00:08:25 +0800 Subject: [PATCH] chore(ci): ignore quick-xml dos advisories pinned by wayland/zbus MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RUSTSEC-2026-0194 / -0195 flag quick-xml < 0.41 for XML-parsing DoS. quick-xml only reaches this tree through wayland-scanner (build-time parse of the bundled wayland protocol XML) and zbus_xml/ashpd (local D-Bus introspection replies) — never attacker-controlled input — and both pin quick-xml requirements below 0.41, so there is no upgrade path yet. Documented ignore, same pattern as the backoff/ttf-parser entries; revisit when the wayland/zbus stacks bump quick-xml. --- deny.toml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/deny.toml b/deny.toml index 283cec29d..dd82b27f5 100644 --- a/deny.toml +++ b/deny.toml @@ -50,6 +50,15 @@ ignore = [ # maintained replacement, and the advisory is informational (no # vulnerability). Revisit when the upstream font crates migrate off it. "RUSTSEC-2026-0192", + # quick-xml < 0.41 DoS advisories (quadratic duplicate-attribute check / + # unbounded NsReader namespace allocation). quick-xml reaches this tree + # only through the Linux windowing + D-Bus stacks — wayland-scanner + # (parses the BUNDLED wayland protocol XML at build time) and + # zbus_xml/ashpd (parse local D-Bus introspection replies) — never + # attacker-controlled XML. No upgrade path until wayland-scanner / + # zbus_xml bump their quick-xml requirement to >= 0.41. + "RUSTSEC-2026-0194", + "RUSTSEC-2026-0195", ] [bans]