From 69c7cf3aa9c10d6129c320a0dc8d520c189aee98 Mon Sep 17 00:00:00 2001 From: luka-loehr Date: Tue, 18 Aug 2026 20:48:16 +0000 Subject: [PATCH] deps: fix the webbrowser argument-injection advisory (RUSTSEC-2026-0257) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit webbrowser 1.2.1 substituted the caller's URL into the BROWSER template BEFORE tokenising on whitespace, so a non-http(s) URL whose parsed form keeps spaces could smuggle extra arguments into the launched browser — `--remote-debugging-port` and `--proxy-server` were both demonstrated against Chromium. This is not theoretical for the CLI. Of the three `webbrowser::open` call sites, two open a URL that came from a server response: the device-flow `verification_uri_complete` (auth/device.rs) and the link returned by the open-in-browser command (main.rs). Only the OAuth authorize URL is built locally. Bumps to 1.2.4, which tokenises before substituting, and turns on the crate's `hardened` feature as defence in depth: every URL this CLI opens is https, so refusing every other scheme costs nothing. cargo deny (advisories, bans, licenses, sources) ok; fmt, clippy -D warnings, 290 tests, and the no-default-features TLS combo all pass. --- Cargo.lock | 65 ++++++++++++++++++++++++++++++++++++------------------ Cargo.toml | 7 +++++- 2 files changed, 50 insertions(+), 22 deletions(-) diff --git a/Cargo.lock b/Cargo.lock index cc068f3..cfa46a4 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -88,7 +88,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -99,7 +99,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -345,16 +345,6 @@ version = "0.9.6" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8" -[[package]] -name = "core-foundation" -version = "0.10.1" -source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "b2a6cd9ae233e7f62ba4e9353e81a88df7fc8a5987b8d445b4d90c879bd156f6" -dependencies = [ - "core-foundation-sys", - "libc", -] - [[package]] name = "core-foundation-sys" version = "0.8.7" @@ -529,7 +519,17 @@ dependencies = [ "libc", "option-ext", "redox_users", - "windows-sys 0.61.2", + "windows-sys 0.60.2", +] + +[[package]] +name = "dispatch2" +version = "0.3.1" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "1e0e367e4e7da84520dedcac1901e4da967309406d1e51017ae1abfb97adbd38" +dependencies = [ + "bitflags", + "objc2", ] [[package]] @@ -615,7 +615,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -1352,6 +1352,28 @@ dependencies = [ "objc2-encode", ] +[[package]] +name = "objc2-app-kit" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "d49e936b501e5c5bf01fda3a9452ff86dc3ea98ad5f283e1455153142d97518c" +dependencies = [ + "bitflags", + "objc2", + "objc2-foundation", +] + +[[package]] +name = "objc2-core-foundation" +version = "0.3.2" +source = "registry+https://github.com/rust-lang/crates.io-index" +checksum = "2a180dd8642fa45cdb7dd721cd4c11b1cadd4929ce112ebd8b9f5803cc79d536" +dependencies = [ + "bitflags", + "dispatch2", + "objc2", +] + [[package]] name = "objc2-encode" version = "4.1.0" @@ -1366,6 +1388,7 @@ checksum = "e3e0adef53c21f888deb4fa59fc59f7eb17404926ee8a6f59f5df0fd7f9f3272" dependencies = [ "bitflags", "objc2", + "objc2-core-foundation", ] [[package]] @@ -1836,7 +1859,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2115,7 +2138,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -2204,7 +2227,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2645,15 +2668,15 @@ dependencies = [ [[package]] name = "webbrowser" -version = "1.2.1" +version = "1.2.4" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "0fc95580916af1e68ff6a7be07446fc5db73ebf71cf092de939bbf5f7e189f72" +checksum = "62c35be770821a214dbc362fc26908c853e776c0004294d0b10b8a6bad582f94" dependencies = [ - "core-foundation", "jni", "log", "ndk-context", "objc2", + "objc2-app-kit", "objc2-foundation", "url", "web-sys", @@ -2674,7 +2697,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] diff --git a/Cargo.toml b/Cargo.toml index b6fe544..84a8b7e 100644 --- a/Cargo.toml +++ b/Cargo.toml @@ -43,7 +43,12 @@ tokio = { version = "1.45", features = ["macros", "rt-multi-thread", "time", "si toml = "0.8" url = "2.5" uuid = { version = "1.17", features = ["v4", "v5"] } -webbrowser = "1.0" +# `hardened` refuses anything that is not http(s). Every URL we open is an +# https endpoint, two of them straight out of a server response, and +# RUSTSEC-2026-0257 was an argument injection through a non-http(s) URL — so +# there is nothing to lose and a whole class of input to reject (defence in +# depth on top of the 1.2.2 fix). +webbrowser = { version = "1.2.2", features = ["hardened"] } zip = { version = "6", default-features = false, features = ["deflate-flate2"] } [features]