Mai haɓaka Rust framework actix-web ya goge ma'ajiyar saboda zalunci

Mawallafin tsarin gidan yanar gizo da aka rubuta cikin Rust actix-web share wurin ajiya bayan da aka zarge shi da yin amfani da harshen Tsatsa. Tsarin yanar gizo na actix, kunshin wanda aka sauke sama da sau dubu 800, yana ba ku damar shigar da sabar HTTP da ayyukan abokin ciniki cikin aikace-aikacen Rust, kuma an tsara shi don cimma matsakaicin aiki da aiki. yana kan gaba a yawancin gwaje-gwajen tsarin gidan yanar gizo.

Jim kadan kafin faruwar lamarin, an bayar da rahoton a cikin al'amurran da suka shafi GitHub cewa an gano Halayen da ba a bayyana ba a cikin lambar sabar yanar gizo na actix-web, wanda ke faruwa a cikin wani shingen da aka kashe a cikin unsafe (yana ba da damar ayyuka marasa aminci tare da masu nuni). Marubucin actix-web bai cire toshe mara lafiya ba, amma ya sake yin kiran zuwa wannan toshe domin kada halin da ba a bayyana shi ba. Marubucin ya ƙi ba da shawarwari don cire rashin lafiya, yana yin la'akari da yiwuwar asarar aiki kuma yana bayyana cewa baya amfani da rashin lafiya ba dole ba kuma yana da tabbaci ga amincin tubalan da ke aiki a wannan yanayin.

Memban ƙungiyar RustSec wanda ya gano halayen da ba a bayyana ba ya ƙi yarda kuma ya ba da shawarar cewa amfani da yawancin tubalan marasa aminci a cikin yanar gizo na actix ba daidai ba ne. Bayan haka ya buga
labarin game da rashin yarda da yin amfani da rashin lafiya, wanda, a tsakanin sauran abubuwa, an ambaci cewa hanyar yin aiki tare da masu nuna alama da aka yi amfani da su a cikin yanar gizo na actix-web (masu da yawa masu canzawa zuwa bayanai iri ɗaya) na iya haifar da lahani na amfani-bayan-free kuma baya yin amfani da shi. dace da yanayin ci gaba akan Tsatsa.

bayan tattaunawa labarai akan Reddit, a cikin batutuwa akan GitHub gudu sama trolls da marubucin actix-web an yi musu hukunci yawan suka da kuma cin mutuncin tsatsa. Marubucin ya kasa jure matsi na tunani, share ma'ajiyar и ya rubuta, cewa na daina tare da Open Source.

source: budenet.ru