katana-render-runtime 0.4.21 → 0.4.22
Evidence: 1 changed. Static findings: 40 new, 8 gone. Run check: 7 changed.
48
medium
48
medium
Evidence
1 changed, 6 the same.
| Change | Points | Signal | What |
|---|---|---|---|
| added | 0 | static:obfuscated_data katana-render-runtime |
medium severity obfuscated_data in library code (2 places): <p id=status></p><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/wAALCAAIAAgBAREA/8QAFAABAAAAAA… |
Package
- Build script
- no change
- Proc macro
- no change
- links
- no change
- New dependencies
- image, moxcms, pxfm
Static findings
40 new, 8 gone, 243 the same. Code that only moved counts as the same.
New in 0.4.22
medium obfuscated_data library 2
<p id=status></p><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/wAALCAAIAAgBAREA/8QAFAABAAAAAA…src/renderer/backends/html_runtime_image_lifecycle_tests.rs:166<p id=status></p><img src="data:image/jpeg;base64,/9j/4AAQSkZJRgABAQAAAQABAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0aHBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMj…src/renderer/backends/html_runtime_image_lifecycle_tests.rs:176
medium included_binary library 1
vendor/drawio/31.6.1/drawio.min.js.br (553439 bytes)src/markdown/runtime_assets.rs:76
low network_access library 4
std::net::TcpListener::bindsrc/renderer/backends/html_subresources/transport_http_tests.rs:85 src/renderer/backends/html_subresources/transport_http_tests.rs:112std::net::TcpListenersrc/renderer/backends/html_subresources/transport_http_tests.rs:130std::net::TcpStreamsrc/renderer/backends/html_subresources/transport_http_tests.rs:143
info url_literal library 33
https://github.com/jgraph/drawio/releases/tag/v31.6.1src/markdown/runtime_assets.rs:43https://example.test/requirements-v1.html#s15src/renderer/backends/html_browser/session_requirements_tests.rs:8https://example.test/index.htmlsrc/renderer/backends/html_runtime/dom_state_lookup.rs:246 src/renderer/backends/html_runtime/session_runtime.rs:472 src/renderer/backends/html_runtime/session_runtime.rs:488 src/renderer/backends/html_runtime/session_runtime.rs:523 src/renderer/backends/html_subresources/document.rs:196 src/renderer/backends/html_subresources/document.rs:218 src/renderer/backends/html_subresources/document.rs:233 src/renderer/backends/html_subresources/document.rs:275 src/renderer/backends/html_subresources/document.rs:320 src/renderer/backends/html_subresources/document.rs:345 src/renderer/backends/html_subresources/document_scripts.rs:130 src/renderer/backends/html_subresources/document_scripts.rs:159 src/renderer/backends/html_subresources/document_scripts.rs:188 src/renderer/backends/html_subresources/document_scripts.rs:203 src/renderer/backends/html_subresources/document_scripts.rs:232 src/renderer/backends/html_subresources/document_scripts.rs:259https://example.test/changed.pngsrc/renderer/backends/html_runtime/dom_state_lookup.rs:270 src/renderer/backends/html_runtime/dom_state_lookup.rs:283<p id=status></p><img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///ywAAAAAAQABAAACAf8AOw==" onload="document.getElementById('status').textContent += 'gif-load|'" onerror="document.getElementByI…src/renderer/backends/html_runtime_data_url_decoder_tests.rs:8<svg xmlns="http://www.w3.org/2000/svg">{}</svg>src/renderer/backends/html_runtime_image_lifecycle_tests.rs:102\u{feff}<svg xmlns="http://www.w3.org/2000/svg"/>src/renderer/backends/html_runtime_svg_lifecycle_tests.rs:9\u{feff}<?xml version="1.0"?><svg xmlns="http://www.w3.org/2000/svg"/>src/renderer/backends/html_runtime_svg_lifecycle_tests.rs:10<!-- before root --><svg xmlns="http://www.w3.org/2000/svg"/>src/renderer/backends/html_runtime_svg_lifecycle_tests.rs:11<!DOCTYPE svg [<!ELEMENT svg ANY>]><svg xmlns="http://www.w3.org/2000/svg"/>src/renderer/backends/html_runtime_svg_lifecycle_tests.rs:12\u{feff}<?xml version="1.0"?>\u{a}<!-- comment -->\u{a}<!DOCTYPE svg><svg xmlns="http://www.w3.org/2000/svg"/>src/renderer/backends/html_runtime_svg_lifecycle_tests.rs:13http://www.w3.org/2000/svgsrc/renderer/backends/html_subresources/image_data.rs:7ftp://example.test/image.pngsrc/renderer/backends/html_subresources/transport_http_tests.rs:12file://example.test/unsupportedsrc/renderer/backends/html_subresources/transport_http_tests.rs:55http://127.0.0.1:0/unreachablesrc/renderer/backends/html_subresources/transport_http_tests.rs:62http://{address}/truncatedsrc/renderer/backends/html_subresources/transport_http_tests.rs:103http://{address}/avatar?id=1src/renderer/backends/html_subresources/transport_http_tests.rs:124
Gone since 0.4.21
8 findings
medium included_binary library 1
vendor/drawio/31.5.3/drawio.min.js.br (550651 bytes)src/markdown/runtime_assets.rs:76
low network_access library 1
std::net::TcpListener::bindsrc/renderer/backends/html_subresources/transport.rs:159
info url_literal library 6
https://github.com/jgraph/drawio/releases/tag/v31.5.3src/markdown/runtime_assets.rs:43ftp://example.test/image.pngsrc/renderer/backends/html_subresources/transport.rs:111file://example.test/unsupportedsrc/renderer/backends/html_subresources/transport.rs:123http://127.0.0.1:0/unreachablesrc/renderer/backends/html_subresources/transport.rs:130https://example.test/{path}src/renderer/backends/html_subresources/transport.rs:137http://{address}/truncatedsrc/renderer/backends/html_subresources/transport.rs:177
Run: check
Processes 5 new, 2 gone, 33 the same
Processes are compared by their program and their place in the tree, not by arguments or times. Grey rows are only there to show where a change sits.
New in 0.4.22
| Process | Arguments | Exit |
|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 25856 |
| └build_script libm | 0 | |
| └build_script num-traits | 0 | |
| └rustc /usr/local/bin/rustc ×3 | --version --verbose | 0 |
| └build_script httparse | 0 | |
| └rustc /usr/local/bin/rustc | --version | 0 |
Gone since 0.4.21
| Process | Arguments | Exit |
|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 25856 |
| └build_script paste | 0 | |
| └rustc /usr/local/bin/rustc | --version | 0 |
Network 0 changed, 3 the same
No change.
Files 0 changed, 0 the same
No change.
Behavior
1 new, 0 gone, 5 the same.
New in 0.4.22
static:obfuscated_data