colored-rs / colored

(Rust) Coloring terminal so simple you already know how to do it !

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

atty has a cve and could be replaced by is-terminal

nstinus opened this issue · comments

warning[unsound]: Potential unaligned read
  ┌─ Cargo.lock:4:1
  │
4 │ atty 0.2.14 registry+https://github.com/rust-lang/crates.io-index
  │ ----------------------------------------------------------------- unsound advisory detected
  │
  = ID: RUSTSEC-2021-0145
  = Advisory: https://rustsec.org/advisories/RUSTSEC-2021-0145
  = On windows, `atty` dereferences a potentially unaligned pointer.
    
    In practice however, the pointer won't be unaligned unless a custom global allocator is used.
    
    In particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.
    
    # atty is Unmaintained
    
    A Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.
    
    Last release of `atty` was almost 3 years ago.
    
    ## Possible Alternative(s)
    
    The below list has not been vetted in any way and may or may not contain alternatives;
    
     - [is-terminal](https://crates.io/crates/is-terminal)
     - std::io::IsTerminal *nightly-only experimental*
  = Announcement: https://github.com/softprops/atty/issues/50
  = Solution: No safe upgrade is available!
  = atty v0.2.14
    └── colored v2.0.0

Already fixed by #122