GHSA-xmrp-424f-vfpx SQLx Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts

• crates.io sqlx: < 0.8.1 → fixed in 0.8.1

The following presentation at this year's DEF CON was brought to our attention on the SQLx Discord: > SQL Injection isn't Dead: Smuggling Queries at the Protocol Level > > (Archive link for posterity.) Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to overflow, causing the server to interpret the rest of the string as binary protocol commands or other data. It appears SQLx _does_ perform truncating casts in a way that could be problematic, for example: This code has existed essentially since the beginning, so it is reasonable to assume that all published versions `` and `Text` adapters have no reasonable way to predict or estimate the final encoded size, so they just return `size_of::()` instead. For web application backends, consider adding some middleware that limits the size of request bodies by default. Resolution Work has started on a branch to add `#[deny]` directives for the following Clippy lints: • `cast_possible_truncation` • `cast_possible_wrap` • `cast_sign_loss` and to manually audit the code that they flag. A fix is expected to be included in the `0.8.1` release (still WIP as of writing).