From 4cc7b90484ab8054090b78ea59645b5904e57efb Mon Sep 17 00:00:00 2001 From: Yihau Chen Date: Wed, 2 Oct 2024 23:56:43 +0800 Subject: [PATCH] v2.0: ignore tonic audit report (#3051) * fix audit * add more comment --- ci/do-audit.sh | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/ci/do-audit.sh b/ci/do-audit.sh index df395e8a2bbc22..aca50d122f3d1f 100755 --- a/ci/do-audit.sh +++ b/ci/do-audit.sh @@ -33,6 +33,12 @@ cargo_audit_ignores=( # curve25519-dalek --ignore RUSTSEC-2024-0344 + + # tonic + # When using tonic::transport::Server there is a remote DoS attack that can cause + # the server to exit cleanly on accepting a tcp/tls stream. + # Ignoring because we do not use this functionality. + --ignore RUSTSEC-2024-0376 ) scripts/cargo-for-all-lock-files.sh audit "${cargo_audit_ignores[@]}" | $dep_tree_filter # we want the `cargo audit` exit code, not `$dep_tree_filter`'s