Released version of prost-reflect contains binary data
#137
Comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
{{ message }}
Released version of
The current released version (0.14.3) of
prost-reflectuploaded to crates.io contains binary data. This is not desirable as it's hard to review these data for correctness. Additionally such binary data might be the starting point of a supply chain attack similar to what happened with the xz library earlier this year.https://diff.rs/prost-reflect/0.14.2/0.14.3
I can see binary data at least in
src/well_known_types.bindoc/file_descriptor_set.binIn this particular case it seems like the binary data contain protobuf file descriptors, which might be useful in certain cases. Nevertheless it would be desirable to not include them by for the reasons outlined above explicitly excluding in your Cargo.toml file:
The text was updated successfully, but these errors were encountered: