deps: fix the webbrowser argument-injection advisory (RUSTSEC-2026-0257) - #3
Merged
Conversation
webbrowser 1.2.1 substituted the caller's URL into the BROWSER template BEFORE tokenising on whitespace, so a non-http(s) URL whose parsed form keeps spaces could smuggle extra arguments into the launched browser — `--remote-debugging-port` and `--proxy-server` were both demonstrated against Chromium. This is not theoretical for the CLI. Of the three `webbrowser::open` call sites, two open a URL that came from a server response: the device-flow `verification_uri_complete` (auth/device.rs) and the link returned by the open-in-browser command (main.rs). Only the OAuth authorize URL is built locally. Bumps to 1.2.4, which tokenises before substituting, and turns on the crate's `hardened` feature as defence in depth: every URL this CLI opens is https, so refusing every other scheme costs nothing. cargo deny (advisories, bans, licenses, sources) ok; fmt, clippy -D warnings, 290 tests, and the no-default-features TLS combo all pass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CLI CI has been red on
mainsince this advisory published. Unlike the other SDK CI failures I cleared today, this one is not ambient — it is reachable here.webbrowser1.2.1 substitutes the caller's URL into theBROWSERtemplate before tokenising on whitespace, so a non-http(s) URL whose parsed form retains spaces smuggles extra arguments into the launched browser.--remote-debugging-port(exposes a local DevTools endpoint) and--proxy-server(redirects browser traffic) were both demonstrated against Chromium.Two of this CLI's three
webbrowser::opencall sites open a URL that came from a server response — the device-flowverification_uri_completeinauth/device.rsand the link inmain.rs. Only the OAuth authorize URL is locally constructed.hardenedfeature, which refuses non-http(s) URLs outright. Every URL this CLI opens is https, so it costs nothing and removes the input class the advisory depends on.cargo deny --locked check→ advisories ok, bans ok, licenses ok, sources ok.cargo fmt --check,cargo clippy --locked --all-targets --all-features -- -D warnings,cargo test --locked --all-features(290 passed / 0 failed) and the--no-default-features --features tls-rustcryptocheck all pass.