Skip to main content

max / makenotwork

Clear run 74's audit, deny and ratchet gates Park RUSTSEC-2026-0269 (8.8, WASI filesystem sandbox escape) alongside the existing RUSTSEC-2026-0222, with the reachability argument in .cargo/audit.toml and mirrored in deny.toml. Neither is reachable by bumping anything we control: both arrive through yara-x, and every fixed range skips the 43 line that yara-x 1.19.0 pins. yara-x 1.20.0 does not help either, moving only to wasmtime 45.0.3 which the fixes also skip. The load-bearing claim for 0269 is that WASI is never compiled here. yara-x takes wasmtime with default-features = false and only cranelift and runtime, and wasmtime-wasi, wasi-common and the cap-std family are absent from Cargo.lock, so no filesystem sandbox exists to escape. Refresh 0222's note for its drifted line numbers. Lower UNTESTED_HIGH_WATER to 32, which is the ratchet working as designed: coverage improved and the constant follows it down. MNW server d551fbbc tracks pruning both ignores when yara-x moves to a fixed wasmtime.
Co-Authored-By
Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session
https://claude.ai/code/session_01MptwXZ8k65v19rFmdGAyki
Author: Max Johnson <me@maxj.phd> · 2026-08-31 12:53 UTC
Signed with PGP, not checked
Commit: 89a6374da4211d1cfa38f6917819325dd249c24f
Parent: ef0c345
4 files changed, +76 insertions, -34 deletions
M server/Cargo.lock +12 -12
@@ -10767,18 +10767,6 @@
10767 10767 name = "synckit-config"
10768 10768 version = "0.2.0"
10769 10769
10770 - [[patch.unused]]
10771 - name = "kberg"
10772 - version = "0.1.0"
10773 -
10774 - [[patch.unused]]
10775 - name = "ops-status"
10776 - version = "0.1.0"
10777 -
10778 - [[patch.unused]]
10779 - name = "painhours"
10780 - version = "0.1.0"
10781 -
10782 10770 [[patch.unused]]
10783 10771 name = "quasi-immediate"
10784 10772 version = "0.93.0"
@@ -10794,3 +10782,15 @@
10794 10782 [[patch.unused]]
10795 10783 name = "quasi-tauri"
10796 10784 version = "0.93.0"
10785 +
10786 + [[patch.unused]]
10787 + name = "kberg"
10788 + version = "0.1.0"
10789 +
10790 + [[patch.unused]]
10791 + name = "ops-status"
10792 + version = "0.1.0"
10793 +
10794 + [[patch.unused]]
10795 + name = "painhours"
10796 + version = "0.1.0"
M server/deny.toml +16 -5
@@ -29,12 +29,23 @@
29 29 # `informational = "unmaintained"`, which `[advisories] version = 2` does not
30 30 # report for a transitive crate, so mirroring it only bought a permanent
31 31 # `advisory-not-detected` warning on every run.
32 - # wasmtime "Stores can mix up type indices between engines" (3.8 low), via
33 - # yara-x 1.19.0, which pins the 43 line while the fixes skip it. Not
34 - # applicable: the bug needs two wasmtime Engines and production builds
35 - # exactly one (scanning/mod.rs:499). Full rationale + the condition that
36 - # would invalidate it: .cargo/audit.toml.
32 + #
33 + # Two wasmtime advisories, both via yara-x 1.19.0, which declares
34 + # wasmtime "43.0.2" with default-features = false and only the cranelift and
35 + # runtime features. The fixes skip the 43 line, so neither is reachable by
36 + # bumping anything we control.
37 + #
38 + # RUSTSEC-2026-0222 (3.8 low): needs two wasmtime Engines and production
39 + # builds exactly one (scanning/mod.rs:505).
40 + #
41 + # RUSTSEC-2026-0269 (8.8 high): a WASI filesystem sandbox escape. WASI is
42 + # not compiled here at all; wasmtime-wasi, wasi-common and the cap-std
43 + # family are absent from Cargo.lock, so there is no sandbox to escape.
44 + #
45 + # Full rationale and the conditions that would invalidate each:
46 + # .cargo/audit.toml.
37 47 "RUSTSEC-2026-0222",
48 + "RUSTSEC-2026-0269",
38 49 ]
39 50
40 51 [bans]
@@ -26,30 +26,61 @@
26 26 "RUSTSEC-2025-0134", # rustls-pemfile (unmaintained), via AWS SDK TLS
27 27 "RUSTSEC-2026-0173", # proc-macro-error2 (unmaintained), via a macro dep
28 28
29 - # wasmtime 43.0.2, "Stores can mix up type indices between engines"
30 - # (3.8 low, published 2026-07-31), reached only through yara-x 1.19.0, which
31 - # is the current release and pins the 43 line. The fixed ranges are 24.0.12+,
32 - # 36.0.13+, 46.0.2+ and 47.0.3+ — they skip 43 entirely, so there is no
33 - # version reachable by bumping anything we control. Waiting on yara-x.
29 + # Two wasmtime advisories, both reached only through yara-x, which is the
30 + # only path to wasmtime in this graph (`cargo tree -i wasmtime`). yara-x
31 + # 1.19.0 declares `wasmtime = "43.0.2"` with `default-features = false` and
32 + # `features = ["cranelift", "runtime"]`, so 46.x is not reachable by bumping
33 + # anything we control and the feature set is the load-bearing fact for both
34 + # entries below. Waiting on yara-x in each case.
35 + #
36 + # Checked 2026-08-31: yara-x 1.20.0 does NOT help. It moves wasmtime to
37 + # 45.0.3, which every fixed range below also skips, with the same
38 + # default-features = false and the same two features. Bumping yara-x is
39 + # not the way out of either advisory; a wasmtime 46/47 line is.
40 +
41 + # RUSTSEC-2026-0222, "Stores can mix up type indices between engines"
42 + # (3.8 low, published 2026-07-31). Fixed in 24.0.12+, 36.0.13+, 46.0.2+ and
43 + # 47.0.3+, which skip the 43 line entirely.
34 44 #
35 45 # Not applicable as we run it. The precondition is a store crossing between
36 - # two wasmtime Engines, and production builds exactly one: scanning/mod.rs:499
46 + # two wasmtime Engines, and production builds exactly one: scanning/mod.rs:505
37 47 # calls yara::compile_rules_from_dir once while constructing the ScanEngine,
38 - # and every other yara_x::Compiler::new() in the tree is under #[cfg(test)].
39 - # One engine for the process lifetime means two engines never exist to
40 - # confuse. THAT is the load-bearing claim here — if a second compile ever
41 - # lands in a production path, this ignore stops being justified and has to be
42 - # re-argued (see the note in scanning/yara.rs).
48 + # and every other yara_x::Compiler::new() in the tree sits under the
49 + # #[cfg(test)] at scanning/mod.rs:884. One engine for the process lifetime
50 + # means two engines never exist to confuse. THAT is the load-bearing claim
51 + # here: if a second compile ever lands in a production path, this ignore stops
52 + # being justified and has to be re-argued (see the note in scanning/yara.rs).
43 53 #
44 54 # Worth being precise about the blast radius rather than calling it isolated:
45 - # yara-x runs IN-PROCESS, in the server's address space (scanning/mod.rs:192).
55 + # yara-x runs IN-PROCESS, in the server's address space (the ScanPipeline
56 + # holds the rules at scanning/mod.rs:429 and pushes the layer at :827).
46 57 # What does bound it is that scanning happens on a dedicated worker pool off
47 58 # the request path, a panic in a CPU layer is caught and converted to a
48 59 # fail-closed scan_panic verdict rather than unwinding the worker, and the
49 60 # CPU layers carry a wall-clock deadline. Defense in depth, not a sandbox.
50 - #
51 - # Monitoring: cargo-deny reports an unreachable ignore as
52 - # `advisory-not-detected`, so this entry announces its own obsolescence once
53 - # yara-x moves to a fixed wasmtime. Prune it then.
54 61 "RUSTSEC-2026-0222",
62 +
63 + # RUSTSEC-2026-0269, "Filesystem sandbox escape when paths or symlinks
64 + # contain trailing slashes" (8.8 high, published 2026-08-20). Fixed in
65 + # 24.0.13+, 36.0.14+, 46.0.3+ and 47.0.4+, which skip the 43 line entirely.
66 + # The high severity is real for anyone running WASI. We do not.
67 + #
68 + # Not applicable, and for a stronger reason than 0222: the vulnerable code is
69 + # not compiled. The bug is in wasmtime's WASI filesystem implementation, and
70 + # the filesystem sandbox it escapes only exists when WASI is built. yara-x
71 + # takes wasmtime with `default-features = false` and exactly two features,
72 + # `cranelift` and `runtime`, embedding it as a bare JIT to execute compiled
73 + # YARA rule bytecode. Nothing enables WASI, and the crates that implement it
74 + # are absent from Cargo.lock entirely:
75 + #
76 + # wasmtime-wasi, wasi-common, cap-std, cap-primitives,
77 + # cap-fs-ext, system-interface -> none present
78 + #
79 + # THAT is the load-bearing claim: no WASI in the graph, so no filesystem
80 + # sandbox exists to escape. It is invalidated the moment any of those crates
81 + # appears in Cargo.lock, or yara-x enables a WASI feature, or we embed
82 + # wasmtime ourselves for anything. Re-argue it then rather than carrying it
83 + # forward. Guest wasm here is compiled YARA rules we produce from our own
84 + # rules directory, never attacker-supplied.
85 + "RUSTSEC-2026-0269",
55 86 ]
@@ -33,7 +33,7 @@
33 33 /// Lower it when you cover one. Never raise it: a new untested file in these
34 34 /// areas is the thing this seal exists to refuse. If you genuinely need to add
35 35 /// one, the honest move is to write the test, not to bump the constant.
36 - const UNTESTED_HIGH_WATER: usize = 33;
36 + const UNTESTED_HIGH_WATER: usize = 32;
37 37
38 38 /// Anything that moves money or decides what someone is entitled to.
39 39 const MONEY: &[&str] = &[