Cargo audit vuln ignored: RUSTSEC-2020-0043

[paulhauner]

Description

In #1670 I am going to add --ignore RUSTSEC-2020-0043 here:

lighthouse/Makefile

Line 140 in 3412a3e

cargo audit

So we can suppress this error which prevents CI from passing:

ID:       RUSTSEC-2020-0043
Crate:    ws
Version:  0.9.1
Date:     2020-09-25
URL:      https://rustsec.org/advisories/RUSTSEC-2020-0043
Title:    Insufficient size checks in outgoing buffer in ws allows remote attacker to run the process out of memory
Solution:  No safe upgrade is available!
Dependency tree:
ws 0.9.1
└── websocket_server 0.2.0
    ├── client 0.2.0
    │   └── beacon_node 0.2.11
    │       ├── node_test_rig 0.2.0
    │       │   ├── simulator 0.2.0
    │       │   ├── rest_api 0.2.0
    │       │   │   └── client 0.2.0
    │       │   └── beacon_node 0.2.11
    │       ├── lighthouse 0.2.11
    │       └── boot_node 0.2.11
    │           └── lighthouse 0.2.11
    └── beacon_chain 0.2.0
        ├── timer 0.2.0
        │   └── client 0.2.0
        ├── rest_types 0.2.0
        │   ├── validator_client 0.2.11
        │   │   ├── simulator 0.2.0
        │   │   ├── node_test_rig 0.2.0
        │   │   └── lighthouse 0.2.11
        │   ├── rest_api 0.2.0
        │   ├── remote_beacon_node 0.2.0
        │   │   ├── validator_client 0.2.11
        │   │   ├── rest_api 0.2.0
        │   │   └── node_test_rig 0.2.0
        │   └── network 0.2.0
        │       ├── rest_api 0.2.0
        │       └── client 0.2.0
        ├── rest_api 0.2.0
        ├── network 0.2.0
        ├── fork_choice 0.1.0
        │   └── beacon_chain 0.2.0
        ├── client 0.2.0
        └── beacon_node 0.2.11

I have suppressed this error since there is not safe upgrade available (according to the above message). Once ws cuts a new release, we should update ASAP.

Interestingly, #1434 will likely remove this dep.

[paulhauner]

I'm pushing this back to A1 since it's for the websocket server which is no longer documented and planned for deprecation.

[paulhauner]

This should disappear when @realbigsean removes the websocket server.

[paulhauner]

PR to remove webserver is here: #1920

[paulhauner]

#1920 has removed this dep, but the ignore still exists in the Makefile:

https://github.com/realbigsean/lighthouse/blob/6574288a4d586aa899f31fc47b71868030afeb8a/Makefile#L143

To close this issue, all we need to do is wait for #1920 to merge, make a PR that removes the ignore in the previous line then wait for CI to pass.