tesaguri

The patch file hotfix-ghsa-2vxv-pv3m-3wvj.patch is a hotfix for Misskey v2024.3.1 (misskey-dev/misskey@78ff90f) aimed at fixing a security issue disclosed by its forks around 2024-04-29Z.

See advisory.md for details of the security issue.

Usage

Use the Docker container image

Pull the image with the following command:

tesaguri

#![feature(try_trait_v2)]

use core::ops::{ControlFlow, FromResidual, Try};

#[allow(dead_code)]
fn questions(x: Undemystifiable) -> Undemystifiable {
    x????????????????????????????????????????????????????????????????
}

struct Undemystifiable;

tesaguri

// This doesn't compile (with good reason!):
#[allow(unused)]
fn reassign_and_return_arg(mut arg: &()) -> &() {
    let local = ();
    arg = &local;
    arg
    //~^ ERROR cannot return value referencing local variable `local`
}

// This doesn't compile either (seemingly without good reason, but consistent with the previous code):

tesaguri

use core::any::TypeId;
use std::collections::HashMap;

#[derive(Default)]
pub struct Extensions {
    map: HashMap<TypeId, Box<dyn DynTryClone>>,
}

#[repr(transparent)]
struct Unclone<T>(T);

tesaguri

use core::fmt;
use core::marker::PhantomData;

use serde::de::{self, IntoDeserializer};

pub struct TransformMapSeed<T> {
    seed: T,
}

pub type TransformMap<T> = TransformMapSeed<PhantomData<T>>;

tesaguri

[package]
name = "erased-deserialize-seed-test"
version = "0.0.0"
edition = "2021"
publish = false

[dependencies]
erased-serde = "0.3"
serde = "1"
serde_json = "1"

tesaguri

use core::fmt;

use serde::de;

pub fn deserialize_into_vec<'de, T, D>(vec: &mut Vec<T>, deserializer: D) -> Result<(), D::Error>
where
    T: de::Deserialize<'de>,
    D: de::Deserializer<'de>,
{
    struct Visitor<'a, T: 'a>(&'a mut Vec<T>);

tesaguri

#![cfg_attr(test, feature(test))]
#![cfg_attr(feature = "int_log", feature(int_log))]

use std::cmp::Ordering;

macro_rules! imp {
    ($lhs:expr, $rhs:expr, |$min:ident, $max:ident| $divisor:expr) => {{
        // Because `'0' < '9' < 'A' < 'Z' (< 'a' < 'z')` holds, we don't need to special-case
        // radixes greater than 10.

tesaguri

use std::cmp::Ordering;
use std::fmt::{self, Display, Write};

struct FmtCmp<T>(T);

impl<T: Display> PartialEq for FmtCmp<T> {
    fn eq(&self, other: &Self) -> bool {
        self.cmp(other) == Ordering::Equal
    }
}

tesaguri

#![feature(type_alias_impl_trait)]

use std::error;
use std::io;

use futures_core::TryFuture;
use futures_util::future::{MapErr, TryFutureExt};

#[allow(type_alias_bounds)] // The bound seems not to be removable.
pub type IoFuture<F: TryFuture> = MapErr<F, impl Fn(<F as TryFuture>::Error) -> io::Error>;