logo

Rust crates reviews

Cryptographically verifiable, distributed dependency reviews

crate: rgb

https://lib.rs/crates/rgb/

Add the last reviewed version to Cargo.toml / [dependencies]:

rgb = "0.8.20"

Filter reviews clicking on the numbers in the summary.

Full column names in tooltip hints: rating Negative, rating Neutral, rating Positive, rating Strong, thoroughness, understanding, reviews count.

Neg
Neu
Pos
Str
tho
und
rev
14
18
4
5
1
2
2
4
4
4
6
crate version
rating
date
reviewer
thoroughness, understanding
rgb 0.8.20
positive
2020-07-08
high, high

Fixed soundness of as_bytes

rgb 0.8.20
positive
2020-07-08
high, high

Fixed soundness of ComponentBytes

rgb 0.8.20
positive
2020-08-29
low, medium

On first glance you'll find a lot of unsafety but most of it is (now) benign.
The largest parts are casting a transparent, repr-C wrapper struct to native
arrays or slices and forwarding impls of bytemuck::{Pod, Zeroable}
accordingly. There's a derive crate for bytemuck that may be used instead.
There are not a lot of safety comments but not a lot of invariants used
either.

rgb 0.8.18
negative
2020-06-14
low, medium
advisories:
high

A longstanding soundness issue of interpreting a user input type T as
bytes... This goes back to 0.2 at least where we have the following trait:

pub trait ComponentBytes<T> {
  fn as_slice(&self) -> &[T];
  fn as_mut_slice(&mut self) -> &mut [T];

  // Provides: does this obvious transmutation cast of `as_slice` result.
  fn as_bytes(&self) -> &[u8] { ... }
}

This is so unsound, the user can even return an wrong slice of an arbitrary
and just let this trait do the dirty work of inspecting its bytes.

In a more recent version we're allowed to even write into that byte slice!
Let us create null references, invalid enums, whatever your heart desires.

rgb 0.8.17
positive
2020-04-23
high, high
rgb 0.8.11
positive
2019-01-06
high, high

it's mine!

rgb 0.8.11
positive
2019-01-06
high, high

it's mine!

rgb 0.8.7
positive
2019-01-05
low, medium
rgb 0.8.7
positive
2019-01-05
high, high

my own

rgb 0.8.7
positive
2019-01-05
low, medium
rgb 0.8.7
positive
2019-01-05
high, high

my own

© bestia.dev 2023, MIT License, Version: 2023.608.1636

Open source repository for this web app: https://github.com/bestia-dev/cargo_crev_web/