{"id":"GHSA-cx7h-h87r-jpgr","summary":"The kstring integration in gix-attributes is unsound","details":"`gix-attributes` (in [`state::ValueRef`](https://github.com/Byron/gitoxide/blob/gix-attributes-v0.22.2/gix-attributes/src/state.rs#L19-L27)) unsafely creates a `&str` from a `&[u8]` containing non-UTF8 data, with the justification that so long as nothing reads the `&str` and relies on it being UTF-8 in the `&str`, there is no UB:\n\n```rust\n// SAFETY: our API makes accessing that value as `str` impossible, so illformed UTF8 is never exposed as such.\n```\n\nThe problem is that the non-UTF8 `str` **is** exposed to outside code: first to the `kstring` crate itself, which requires UTF-8 in its documentation and may have UB as a consequence of this, but also to `serde`, where it propagates to e.g. `serde_json`, `serde_yaml`, etc., where the same problems occur.\n\nThis is not sound, and it could cause further UB down the line in these places that can view the `&str`.\n","aliases":["RUSTSEC-2024-0359"],"modified":"2026-09-10T03:50:16.580555746Z","published":"2024-07-25T16:38:42Z","database_specific":{"github_reviewed_at":"2024-07-25T16:38:42Z","nvd_published_at":null,"cwe_ids":["CWE-172"],"severity":"LOW","github_reviewed":true},"references":[{"type":"WEB","url":"https://github.com/Byron/gitoxide/issues/1460"},{"type":"WEB","url":"https://github.com/GitoxideLabs/gitoxide/issues/1460"},{"type":"WEB","url":"https://github.com/rustsec/advisory-db/commit/884aaa1646132bc3a27ba058197d6ef039bec294"},{"type":"PACKAGE","url":"https://github.com/Byron/gitoxide"},{"type":"WEB","url":"https://rustsec.org/advisories/RUSTSEC-2024-0359.html"}],"affected":[{"package":{"name":"gix-attributes","ecosystem":"crates.io","purl":"pkg:cargo/gix-attributes"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.22.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/07/GHSA-cx7h-h87r-jpgr/GHSA-cx7h-h87r-jpgr.json"}}],"schema_version":"1.9.0"}