fix(deps): update rust crate warp to v0.3.3 [security]

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
warp	dependencies	patch	0.3.1 -> 0.3.3

---

Warp vulnerable to Path Traversal via Improper validation of Windows paths

GHSA-8v4j-7jgf-5rg9 / RUSTSEC-2022-0082

More information

Details

Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed and respond with the contents of c:/windows/web/screen/img101.png. Thus users could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

Severity

High

References

• https://github.com/seanmonstar/warp/issues/937
• https://github.com/seanmonstar/warp/pull/997
• https://github.com/seanmonstar/warp/commit/0074a0a3e98786509259bfe3821d3b3f094257aa
• https://github.com/seanmonstar/warp
• https://rustsec.org/advisories/RUSTSEC-2022-0082.html

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Improper validation of Windows paths could lead to directory traversal attack

GHSA-8v4j-7jgf-5rg9 / RUSTSEC-2022-0082

More information

Details

Path resolution in warp::filters::fs::dir didn't correctly validate Windows paths
meaning paths like /foo/bar/c:/windows/web/screen/img101.png would be allowed
and respond with the contents of c:/windows/web/screen/img101.png. Thus users
could potentially read files anywhere on the filesystem.

This only impacts Windows. Linux and other unix likes are not impacted by this.

Severity

Unknown

References

• https://crates.io/crates/warp
• https://rustsec.org/advisories/RUSTSEC-2022-0082.html
• https://github.com/seanmonstar/warp/issues/937

This data is provided by OSV and the Rust Advisory Database (CC0 1.0).

---

Release Notes

seanmonstar/warp (warp)

v0.3.3

Compare Source

• Fixes:
  • Fix fs filters path sanitization to reject colons on Windows.

v0.3.2

Compare Source

• Features:
  • Add Filter::then(), which is like Filter::map() in that it's infallible, but is async like Filter::and_then().
  • Add redirect::found() reply helper that returns 302 Found.
  • Add compression-brotli and compression-gzip cargo features to enable only the compression you need.
  • Allow HEAD requests to be served to fs::dir() filters.
  • Allow path!() with no arguments.
• Fixes:
  • Update private dependencies Tungstenite and Multipart.
  • Replaces uses of futures with futures-util, which is a smaller dependency.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.