Replace chrono with httpdate internally #361
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Remove chrono as a dependency to avoid any connection to the transitive [CVE-2020-26235 in `time` 0.2](https://github.com/rustsec/advisory-db/blob/9e93a3df4a54e70f2539a2ecdc3d70beef64c856/crates/time/RUSTSEC-2020-0071.md). This also requires removing chrono from the public API of `CookieBuilder`, which is probably for the best anyway before it is released so that we aren't tied to it. Expose `SystemTime` types instead, which both chrono and `time` are compatible with, should the consumer of the API choose to use either of those crates. Replace formatting and parsing of HTTP date formats with the aptly-named `httpdate` crate, which implements exactly those two operations and no more. As a side benefit this reduces our total transitive dependency count by 3 when the `cookies` feature is enabled.
sagebind
added
dependencies
Codecov Report
@@ Coverage Diff @@
## master #361 +/- ##
==========================================
+ Coverage 79.24% 79.38% +0.14%
==========================================
Files 51 51
Lines 3045 3061 +16
==========================================
+ Hits 2413 2430 +17
+ Misses 632 631 -1
Continue to review full report at Codecov.
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Remove chrono as a dependency to avoid any connection to the transitive CVE-2020-26235 in
time0.2. This also requires removing chrono from the public API ofCookieBuilder(added in #349), which is probably for the best anyway before it is released so that we aren't tied to it. ExposeSystemTimetypes instead, which both chrono andtimeare compatible with, should the consumer of the API choose to use either of those crates.Replace formatting and parsing of HTTP date formats with the aptly-named
httpdatecrate, which implements exactly those two operations and no more. As a side benefit this reduces our total transitive dependency count by 3 when thecookiesfeature is enabled.This has been the only thing holding back a 1.6.0 release with #349 in it, since CVE-2020-26235 was brought to wider attention shortly after its merge and I've been thinking on how to best address that concern before the API is released and can't be changed without a BC break.