chore(deps): update rust crate serde_with to 3.21.0 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
serde_with	workspace.dependencies	minor	3.0.0 → 3.21.0

---

serde_with: KeyValueMap serialization panics on empty sequence or map entries

GHSA-7gcf-g7xr-8hxj

More information

Details

Summary

The public KeyValueMap serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts 1 from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through #[serde_as(as = "KeyValueMap<_>")] can be crashed by an empty inner sequence or map entry.

Details

The affected public surface includes:

• Serialization of #[serde_as(as = "KeyValueMap<_>")] values through serde_json::to_string or any other Serde serializer`
• Public KeyValueMap conversions for sequence and map-backed entries`

The root cause is: The KeyValueMap serializer preallocating Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) before checking that the element actually contains the required first key field or item.

The vulnerable data/control flow is: attacker-controlled empty entry -> serde_json::to_string -> KeyValueMap<TAs>::serialize_as -> SeqAsMapSerializer::{serialize_seq,serialize_map} -> Vec::with_capacity(len - 1) or Vec::with_capacity(len.unwrap_or(17) - 1) -> panic

Relevant source locations:

• serde_with/src/key_value_map.rs:590
• serde_with/src/key_value_map.rs:599
• serde_with/src/key_value_map.rs:613
• serde_with/src/key_value_map.rs:632
• serde_with/src/key_value_map.rs:648

PoC

/*
[dependencies]
serde = {version = "*", features = ["derive"]}
serde_with = "*"
serde_json = "*"
*/

use serde::Serialize;
use serde_with::{serde_as, KeyValueMap};

#[derive(Serialize)]

#[serde(transparent)]
struct Seq(Vec<String>);

#[serde_as]

#[derive(Serialize)]
#[serde(transparent)]
struct KVMap {
    #[serde_as(as = "KeyValueMap<_>")]
    foo: Vec<Seq>,
}

fn main() {
    let value = KVMap {
        foo: vec![Seq(Vec::new())],
    };
    let _ = serde_json::to_string(&value).unwrap();
}

Impact

A local attacker who can trigger serialization of attacker-controlled data through KeyValueMap can terminate the process, causing a denial of service.

Severity

• CVSS Score: 5.1 / 10 (Medium)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

• https://github.com/jonasbb/serde_with/security/advisories/GHSA-7gcf-g7xr-8hxj
• https://github.com/jonasbb/serde_with/pull/966
• https://github.com/jonasbb/serde_with/commit/c8a1d820ea25df01692b367058d587343e199389
• https://github.com/jonasbb/serde_with
• https://github.com/jonasbb/serde_with/releases/tag/v3.21.0

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

jonasbb/serde_with (serde_with)

v3.21.0: serde_with v3.21.0

Compare Source

Security

• GHSA-7gcf-g7xr-8hxj: KeyValueMap serialization panics on empty sequence or map entries
  Bad or attacker controlled values could cause a panic while allocating too large values.
  Fixed in #​966 by setting a maximum allocation size during the creation of collections like Vec or sets.

  Thanks to @​7thParkk for reporting the issue.

Added

• Add NoneAsZero adapter that maps Option<NonZero*> to a plain integer, encoding None as 0 by @​SAY-5 (#​486)

Changed

• Re-enable link-to-definition on docs.rs (#​964)

Fixed

• Fix some doc links to point to the correct types (#​963)
• Re-enable unused_qualifications and fix the resulting findings by @​lms0806 (#​962)

v3.20.0: serde_with v3.20.0

Compare Source

Added

• Add support for base58 encoding, similar to the existing base64 setup by @​mitinarseny (#​943)

Fixed

• Extend base64 with schemars support by @​mitinarseny (#​9949)

v3.19.0: serde_with v3.19.0

Compare Source

Added

• Add support for hashbrown v0.17 (#​940)

  This extends the existing support for hashbrown to the newly released version.

v3.18.0: serde_with v3.18.0

Compare Source

Added

• Support OneOrMany with more sequence and set types (#​929)

Changed

• Bump MSRV to 1.88 due to the darling dependency

v3.17.0: serde_with v3.17.0

Compare Source

Added

• Support OneOrMany with smallvec v1 (#​920, #​922)

Changed

• Switch to yaml_serde for a maintained yaml dependency by @​kazan417 (#​921)
• Bump MSRV to 1.82, since that is required for yaml_serde dev-dependency.

v3.16.1: serde_with v3.16.1

Compare Source

Fixed

• Fix JsonSchemaAs of SetPreventDuplicates and SetLastValueWins. (#​906, #​907)

v3.16.0: serde_with v3.16.0

Compare Source

Added

• Added support for smallvec v1 under the smallvec_1 feature flag by @​isharma228 (#​895)
• Add JsonSchemaAs implementation for json::JsonString by @​yogevm15 (#​901)

v3.15.1: serde_with v3.15.1

Compare Source

Fixed

• Fix building of the documentation by updating references to use serde_core.

v3.15.0: serde_with v3.15.0

Compare Source

Added

• Added error inspection to VecSkipError and MapSkipError by @​michelhe (#​878)
  This allows interacting with the previously hidden error, for example for logging.
  Checkout the newly added example to both types.

• Allow documenting the types generated by serde_conv!.
  The serde_conv! macro now acceps outer attributes before the optional visibility modifier.
  This allow adding doc comments in the shape of #[doc = "..."] or any other attributes, such as lint modifiers.

  serde_conv!(
      #[doc = "Serialize bools as string"]
      #[allow(dead_code)]
      pub BoolAsString,
      bool,
      |x: &bool| ::std::string::ToString::to_string(x),
      |x: ::std::string::String| x.parse()
  );

• Add support for hashbrown v0.16 (#​877)

  This extends the existing support for hashbrown v0.14 and v0.15 to the newly released version.

Changed

• Bump MSRV to 1.76, since that is required for toml dev-dependency.

v3.14.1: serde_with v3.14.1

Compare Source

Fixed

• Show macro expansion in the docs.rs generated rustdoc.
  Since macros are used to generate trait implementations, this is useful to understand the exact generated code.

v3.14.0: serde_with v3.14.0

Compare Source

Added

• Add support for Range, RangeFrom, RangeTo, RangeInclusive (#​851)
  RangeToInclusive is currently unsupported by serde.
• Add schemars implementations for Bound, Range, RangeFrom, RangeTo, RangeInclusive.
• Added support for schemars v1 under the schemars_1 feature flag

v3.13.0: serde_with v3.13.0

Compare Source

Added

• Added support for schemars v0.9.0 under the schemars_0_9 feature flag by @​swlynch99 (#​849)
• Introduce SerializeDisplayAlt derive macro (#​833)
  An alternative to the SerializeDisplay macro except instead of using the
  plain formatting like format!("{}", ...), it serializes with the
  Formatter::alternate flag set to true, like format!("{:#}", ...)

Changed

• Generalize serde_with::rust::unwrap_or_skip to support deserializing references by @​beroal (#​832)
• Bump MSRV to 1.71, since that is required for the jsonschema dev-dependency.
• Make serde_conv available without the std feature by @​arilou (#​839)
• Bump MSRV to 1.74, since that is required for schemars v0.9.0 by @​swlynch99 (#​849)

Fixed

• Make the DurationSeconds types and other variants more accessible even without std (#​845)

v3.12.0: serde_with v3.12.0

Compare Source

Added

• Add with_suffix! macro, which puts a suffix on every struct field by @​fgardt (#​381/#​797)

Changed

• Reformat all Cargo.toml files by @​nyurik (#​803)
• Better handle internal arithmetic and improve error messages (#​809/#​810/#​811)

Fixed

• Generated schemas are not valid when using rust style names in ref by @​waltronix (#​798/#​799)

v3.11.0: serde_with v3.11.0

Compare Source

Added

• Add support for hashbrown v0.15 (#​787/#​790)

  This extends the existing support for hashbrown v0.14 to the newly released version.

v3.10.0: serde_with v3.10.0

Compare Source

Added

• Add newline separator by @​jayvdb (#​777)

  The UnixLineSeparator and DosLineSeparator can be used together with StringWithSeparator.

Fixed

• Proper handling of cfg_attr in the serde_as macro by @​sivizius (#​782)

  This allows to parse more valid forms of the cfg_attr macro, including multiple values and attribute that do not follow the key = value schema.

v3.9.0: serde_with v3.9.0

Compare Source

Added

• Deserialize a map` and skip all elements failing to deserialize by @​johnmave126 (#​763)

  MapSkipError acts like a map (HashMap/BTreeMap), but keys or values that fail to deserialize, like are ignored.

  For formats with heterogeneously typed maps, we can collect only the elements where both key and value are deserializable.
  This is also useful in conjunction to #[serde(flatten)] to ignore some entries when capturing additional fields.

  // JSON
  "value": {"0": "v0", "5": "v5", "str": "str", "10": 2},
  
  // Rust
  #[serde_as(as = "MapSkipError<DisplayFromStr, _>")]
  value: BTreeMap<u32, String>,
  
  // Only deserializes entries with a numerical key and a string value, i.e.,
  {0 => "v0", 5 => "v5"}
  

v3.8.3: serde_with v3.8.3

Compare Source

Fixed

• Fix compile issues when dependency schemars_0_8 is used with the preserve_order features (#​762)

v3.8.2: serde_with v3.8.2

Compare Source

Changed

• Bump MSRV to 1.67, since that is required for the time dependency.
  The time version needed to be updated for nightly compatibility.

Fixed

• Implement JsonSchemaAs for OneOrMany instead of JsonSchema by @​swlynch99 (#​760)

v3.8.1: serde_with v3.8.1

Compare Source

Fixed

• Do not emit schemars(deserialize_with = "...") annotations, as schemars does not support them (#​735)
  Thanks to @​sivizius for reporting the issue.

v3.8.0: serde_with v3.8.0

Compare Source

Added

• Implement (De)Serialization for Pinned Smart Pointers by @​Astralchroma (#​733)
• Implement JsonSchemaAs for PickFirst by @​swlynch99 (#​721)

Changed

• Bump base64 dependency to v0.22 (#​724)
• Update dev dependencies

Fixed

• serde_conv regressed and triggered clippy::ptr_arg and add test to prevent future problems. (#​731)

v3.7.0: serde_with v3.7.0

Compare Source

Added

• Implement JsonSchemaAs for EnumMap by @​swlynch99 (#​697)
• Implement JsonSchemaAs for IfIsHumanReadable by @​swlynch99 (#​717)
• Implement JsonSchemaAs for KeyValueMap by @​swlynch99 (#​713)
• Implement JsonSchemaAs for OneOrMany by @​swlynch99 (#​719)

Fixed

• Detect conflicting schema_with attributes on fields with schemars annotations by @​swlynch99 (#​715)
  This extends the existing avoidance mechanism to a new variant fixing #​712.

v3.6.1: serde_with v3.6.1

Compare Source

Changed

• Eliminate dependency on serde's "derive" feature by @​dtolnay (#​694)
  This allows parallel compilation of serde and serde_derive which can speed up the wallclock time.
  It requires that downstream crates do not use the "derive" feature either.

v3.6.0: serde_with v3.6.0

Compare Source

Added

• Add IfIsHumanReadable for conditional implementation by @​irriden (#​690)
  Used to specify different transformations for text-based and binary formats.
• Add more JsonSchemaAs impls for all Duration* and Timestamp* adaptors by @​swlynch99 (#​685)

Changed

• Bump MSRV to 1.65, since that is required for the regex dependency.

v3.5.1: serde_with v3.5.1

Compare Source

Fixed

• The serde_as macro now better detects existing schemars attributes on fields and incorporates them by @​swlynch99 (#​682)
  This avoids errors on existing #[schemars(with = ...)] annotations.

v3.5.0: serde_with v3.5.0

Compare Source

Added

• Support for schemars integration added by @​swlynch99 (#​666)
  The support uses a new Schema top-level item which implements JsonSchema
  The serde_as macro can now detect schemars usage and emits matching annotations for all fields with serde_as attribute.
  Many types of this crate come already with support for the schemars, but support is not complete and will be extended over time.

v3.4.0: serde_with v3.4.0

Compare Source

• Lower minimum required serde version to 1.0.152 (#​653)
  Thanks to @​banool for submitting the PR.

  This allows people that have a problem with 1.0.153 to still use serde_with.

• Add support for core::ops::Bound (#​655)
  Thanks to @​qsantos for submitting the PR.

v3.3.0: serde_with v3.3.0

Compare Source

Added

• Support the hashbrown type HashMap and HashSet (#​636, #​637)
  Thanks to @​OliverNChalk for raising the issue and submitting a PR.

  This extends the existing support for HashMaps and HashSets to the hashbrown crate v0.14.
  The same conversions as for the std and indexmap types are available, like general support for #[serde_as] and converting it to/from sequences or maps.

Changed

• Generalize some trait bounds for DeserializeAs implementations

  While working on #​637 it came to light that some of the macros for generating DeserializeAs implementations were not as generic as they could.
  This means they didn't work with custom hasher types, but only the default hashers.
  This has now been fixed and custom hashers should work better, as long as they implement BuildHasher + Default.

• (internal) Change how features are documented (#​639)

  This change moves the feature documentation into Cargo.toml in a format that can be read by lib.rs.
  It will improve the generated features documentation there.
  The page with all features remains in the guide but is now generated from the Cargo.toml information.

v3.2.0: serde_with v3.2.0

Compare Source

Added

• Add optional support for indexmap v2 (#​621)
  Support for v1 is already available using the indexmap_1 feature.
  This adds identical support for v2 of indexmap using the indexmap_2 feature.

Changed

• Bump MSRV to 1.64, since that is required for the indexmap v2 dependency.

Fixed

• Prevent panics when deserializing i64::MIN using TimestampSeconds<i64> (#​632, #​633)
  Thanks to @​hollmmax for reporting and fixing the issue.

v3.1.0: serde_with v3.1.0

Compare Source

Added

• Add FromIntoRef and TryFromIntoRef (#​618)
  Thanks to @​oblique for submitting the PR.

  The new types are similar to the existing FromInto and TryFromInto types.
  They behave different during serialization, allowing the removal of the Clone bound on their SerializeAs trait implementation

Changed

• Improve documentation about cfg-gating serde_as (#​607)
• Bump MSRV to 1.61 because that is required by the crate cfg_eval.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.