CVE-2021-32814: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Skytable is a NoSQL database with automated snapshots and TLS. Versions prior to 0.5.1 are vulnerable to a a directory traversal attack enabling remotely connected clients to destroy and/or manipulate critical files on the host's file system. This security bug has been patched in version 0.5.1. There are no known workarounds aside from upgrading.
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 8.1
Published: 2021-08-03T17:15Z
Repository: https://github.com/skytable/skytable
Language: Rust
Files changed: .gitignore, .idea/workspace.xml, Cargo.lock, cli/Cargo.toml, libtdb/Cargo.toml, server/Cargo.toml, server/src/admin/mksnap.rs, server/src/cli.yml, server/src/dbnet.rs, server/src/tests/kvengine.rs, tdb-bench/Cargo.toml, tdb-bench/src/cli.yml, tdb-bench/src/main.rs, tdb-macros/Cargo.toml, tdb-macros/src/lib.rs
Commit date: 2021-02-15 10:41:27 +0530
Commit message: Add fix and tests for VE/S/00001
This commit now checks if the second value passed to MKSNAP points
to any parent/root directory before performing any action.

Signed-off-by: Sayan Nandan <nandansayan@outlook.com>

Diff: diff --git a/.gitignore b/.gitignore
index 81f7756..3fc07f3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,6 +1,7 @@
 /target
 /.vscode
 data.bin
 /server/snapshots
 snapstore.bin
-snapstore.partmap
\ No newline at end of file
+snapstore.partmap
+/snapshots 
\ No newline at end of file
diff --git a/.idea/workspace.xml b/.idea/workspace.xml
new file mode 100644
index 0000000..1ead40c
--- /dev/null
+++ b/.idea/workspace.xml
@@ -0,0 +1,75 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project version="4">
+  <component name="CMakeRunConfigurationManager" shouldGenerate="true" shouldDeleteObsolete="true">
+    <generated />
+  </component>
+  <component name="CMakeSettings">
+    <configurations>
+      <configuration PROFILE_NAME="Debug" CONFIG_NAME="Debug" ENABLED="true" />
+    </configurations>
+  </component>
+  <component name="CargoProjects">
+    <cargoProject FILE="$PROJECT_DIR$/Cargo.toml" />
+  </component>
+  <component name="ChangeListManager">
+    <list default="true" id="05446e12-25fb-4f56-ae52-664b69a61212" name="Default Changelist" comment="">
+      <change beforePath="$PROJECT_DIR$/server/src/main.rs" beforeDir="false" afterPath="$PROJECT_DIR$/server/src/main.rs" afterDir="false" />
+    </list>
+    <option name="SHOW_DIALOG" value="false" />
+    <option name="HIGHLIGHT_CONFLICTS" value="true" />
+    <option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
+    <option name="LAST_RESOLUTION" value="IGNORE" />
+  </component>
+  <component name="ClangdSettings">
+    <option name="formatViaClangd" value="false" />
+  </component>
+  <component name="Git.Settings">
+    <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
+  </component>
+  <component name="GitSEFilterConfiguration">
+    <file-type-list>
+      <filtered-out-file-type name="LOCAL_BRANCH" />
+      <filtered-out-file-type name="REMOTE_BRANCH" />
+      <filtered-out-file-type name="TAG" />
+      <filtered-out-file-type name="COMMIT_BY_MESSAGE" />
+    </file-type-list>
+  </component>
+  <component name="MacroExpansionManager">
+    <option name="directoryName" value="k3yyr5y2" />
+  </component>
+  <component name="ProjectId" id="1mjP2LZbFlEc2swjliVmxauGK9Q" />
+  <component name="ProjectLevelVcsManager" settingsEditedManually="true" />
+  <component name="ProjectViewState">
+    <option name="hideEmptyMiddlePackages" value="true" />
+    <option name="showLibraryContents" value="true" />
+    <option name="showVisibilityIcons" value="true" />
+  </component>
+  <component name="PropertiesComponent">
+    <property name="RunOnceActivity.OpenProjectViewOnStart" value="true" />
+    <property name="RunOnceActivity.ShowReadmeOnStart" value="true" />
+    <property name="WebServerToolWindowFactoryState" value="false" />
+    <property name="cf.first.check.clang-format" value="false" />
+    <property name="last_opened_file_path" value="$PROJECT_DIR$" />
+    <property name="nodejs_package_manager_path" value="npm" />
+    <property name="org.rust.cargo.project.model.PROJECT_DISCOVERY" value="true" />
+  </component>
+  <component name="RustProjectSettings">
+    <option name="toolchainHomeDirectory" value="$USER_HOME$/.cargo/bin" />
+  </component>
+  <component name="SpellCheckerSettings" RuntimeDictionaries="0" Folders="0" CustomDictionaries="0" DefaultDictionary="application-level" UseSingleDictionary="true" transferred="true" />
+  <component name="TaskManager">
+    <task active="true" id="Default" summary="Default task">
+      <changelist id="05446e12-25fb-4f56-ae52-664b69a61212" name="Default Changelist" comment="" />
+      <created>1610003825159</created>
+      <option name="number" value="Default" />
+      <option name="presentableId" value="Default" />
+      <updated>1610003825159</updated>
+      <workItem from="1610003832233" duration="85000" />
+      <workItem from="1610003959549" duration="724000" />
+    </task>
+    <servers />
+  </component>
+  <component name="TypeScriptGeneratedFilesManager">
+    <option name="version" value="3" />
+  </component>
+</project>
\ No newline at end of file
diff --git a/Cargo.lock b/Cargo.lock
index 576d484..c511773 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -63,13 +63,13 @@ version = "1.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "08c48aae112d48ed9f069b33538ea9e3e90aa263cfa3d1c24309612b1f7472de"
 
 [[package]]
 name = "bytes"
-version = "0.6.0"
+version = "1.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e0dcbc35f504eb6fc275a6d20e4ebcda18cf50d40ba6fabff8c711fa16cb3b16"
+checksum = "b700ce4376041dcd0a327fd0097c41095743c4c8af8887265942faf1100bd040"
 
 [[package]]
 name = "cc"
 version = "1.0.59"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -79,10 +79,16 @@ checksum = "66120af515773fb005778dc07c261bd201ec8ce50bd6e7144c927753fe013381"
 name = "cfg-if"
 version = "0.1.10"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "4785bdd1c96b2a846b2bd7cc02e86b6b3dbf14e7e53446c4f54c92a361040822"
 
+[[package]]
+name = "cfg-if"
+version = "1.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
+
 [[package]]
 name = "chrono"
 version = "0.4.19"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73"
@@ -119,19 +125,19 @@ dependencies = [
  "bitflags",
 ]
 
 [[package]]
 name = "devtimer"
-version = "4.0.0"
+version = "4.0.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6035b7b9244bf9637cd7ef80b5e1c54404bef92cccd34738c85c45f04ae8b244"
+checksum = "907339959a92f6b98846570500c0a567c9aecbb3871cef00561eb5d20d47b7c1"
 
 [[package]]
 name = "env_logger"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f26ecb66b4bdca6c1409b40fb255eefc2bd4f6d135dab3c3124f80ffa2a9661e"
+checksum = "17392a012ea30ef05a610aa97dfb49496e71c9f676b27879922ea5bdf60d9d3f"
 dependencies = [
  "atty",
  "humantime",
  "log",
  "regex",
@@ -142,25 +148,19 @@ dependencies = [
 name = "fs_extra"
 version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2022715d62ab30faffd124d40b76f4134a550a87792276512b18d63272333394"
 
-[[package]]
-name = "futures-core"
-version = "0.3.5"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "59f5fff90fd5d971f936ad674802482ba441b6f09ba5e15fd8b39145582ca399"
-
 [[package]]
 name = "getrandom"
-version = "0.1.15"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
+checksum = "c9495705279e7140bf035dde1f6e750c162df8b625267cd52cc44e0b156732c8"
 dependencies = [
- "cfg-if",
+ "cfg-if 1.0.0",
  "libc",
- "wasi 0.9.0+wasi-snapshot-preview1",
+ "wasi",
 ]
 
 [[package]]
 name = "hermit-abi"
 version = "0.1.15"
@@ -239,15 +239,15 @@ dependencies = [
  "scopeguard",
 ]
 
 [[package]]
 name = "log"
-version = "0.4.11"
+version = "0.4.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
+checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
 dependencies = [
- "cfg-if",
+ "cfg-if 1.0.0",
 ]
 
 [[package]]
 name = "memchr"
 version = "2.3.3"
@@ -336,11 +336,11 @@ dependencies = [
 name = "parking_lot_core"
 version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c361aa727dd08437f2f1447be8b59a33b0edd15e0fcee698f935613d9efbca9b"
 dependencies = [
- "cfg-if",
+ "cfg-if 0.1.10",
  "cloudabi",
  "instant",
  "libc",
  "redox_syscall",
  "smallvec",
@@ -368,54 +368,53 @@ dependencies = [
  "unicode-xid",
 ]
 
 [[package]]
 name = "quote"
-version = "1.0.7"
+version = "1.0.9"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
+checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
 dependencies = [
  "proc-macro2",
 ]
 
 [[package]]
 name = "rand"
-version = "0.7.3"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
+checksum = "0ef9e7e66b4468674bfcb0c81af8b7fa0bb154fa9f28eb840da5c447baeb8d7e"
 dependencies = [
- "getrandom",
  "libc",
  "rand_chacha",
  "rand_core",
  "rand_hc",
 ]
 
 [[package]]
 name = "rand_chacha"
-version = "0.2.2"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
+checksum = "e12735cf05c9e10bf21534da50a147b924d555dc7a547c42e6bb2d5b6017ae0d"
 dependencies = [
  "ppv-lite86",
  "rand_core",
 ]
 
 [[package]]
 name = "rand_core"
-version = "0.5.1"
+version = "0.6.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
+checksum = "34cf66eb183df1c5876e2dcf6b13d57340741e8dc255b48e40a26de954d06ae7"
 dependencies = [
  "getrandom",
 ]
 
 [[package]]
 name = "rand_hc"
-version = "0.2.0"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
+checksum = "3190ef7066a446f2e7f42e239d161e905420ccab01eb967c9eb27d21b2322a73"
 dependencies = [
  "rand_core",
 ]
 
 [[package]]
@@ -424,25 +423,25 @@ version = "0.1.57"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "41cc0f7e4d5d4544e8861606a285bb08d3e70712ccc7d2b84d7c0ccfaf4b05ce"
 
 [[package]]
 name = "regex"
-version = "1.4.2"
+version = "1.4.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "38cf2c13ed4745de91a5eb834e11c00bcc3709e773173b2ce4c56c9fbde04b9c"
+checksum = "d9251239e129e16308e70d853559389de218ac275b515068abc96829d05b948a"
 dependencies = [
  "aho-corasick",
  "memchr",
  "regex-syntax",
  "thread_local",
 ]
 
 [[package]]
 name = "regex-syntax"
-version = "0.6.21"
+version = "0.6.22"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b181ba2dcf07aaccad5448e8ead58db5b742cf85dfe035e2227f137a539a189"
+checksum = "b5eb417147ba9860a96cfe72a0b93bf88fee1744b5636ec99ab20c1aa9376581"
 
 [[package]]
 name = "ryu"
 version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
@@ -454,33 +453,33 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
 [[package]]
 name = "serde"
-version = "1.0.118"
+version = "1.0.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "06c64263859d87aa2eb554587e2d23183398d617427327cf2b3d0ed8c69e4800"
+checksum = "92d5161132722baa40d802cc70b15262b98258453e85e5d1d365c757c73869ae"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.118"
+version = "1.0.123"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c84d3526699cd55261af4b941e4e725444df67aa4f9e6a3564f18030d12672df"
+checksum = "9391c295d64fc0abb2c556bad848f33cb8296276b1ad2677d1ae1ace4f258f31"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.60"
+version = "1.0.62"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1500e84d27fe482ed1dc791a56eddc2f230046a040fa908c08bda1d9fb615779"
+checksum = "ea1c6153794552ea7cf7cf63b1231a25de00ec90db326ba6264440fa08e31486"
 dependencies = [
  "itoa",
  "ryu",
  "serde",
 ]
@@ -493,16 +492,10 @@ checksum = "94f478ede9f64724c5d173d7bb56099ec3e2d9fc2774aac65d34b8b890405f41"
 dependencies = [
  "arc-swap",
  "libc",
 ]
 
-[[package]]
-name = "slab"
-version = "0.4.2"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"
-
 [[package]]
 name = "smallvec"
 version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3757cb9d89161a2f24e1cf78efa0c1fcff485d18e3f55e0aa3480824ddaa0f3f"
@@ -511,11 +504,11 @@ checksum = "3757cb9d89161a2f24e1cf78efa0c1fcff485d18e3f55e0aa3480824ddaa0f3f"
 name = "socket2"
 version = "0.3.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "7fd8b795c389288baa5f355489c65e71fd48a02104600d15c4cfbc561e9e429d"
 dependencies = [
- "cfg-if",
+ "cfg-if 0.1.10",
  "libc",
  "redox_syscall",
  "winapi",
 ]
 
@@ -525,13 +518,13 @@ version = "0.8.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "8ea5119cdb4c55b55d432abb513a0429384878c15dde60cc77b1c99de1a95a6a"
 
 [[package]]
 name = "syn"
-version = "1.0.54"
+version = "1.0.60"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a2af957a63d6bd42255c359c93d9bfdb97076bd3b820897ce55ffbfbf107f44"
+checksum = "c700597eca8a5a762beb35753ef6b94df201c81cca676604f547495a0d7f0081"
 dependencies = [
  "proc-macro2",
  "quote",
  "unicode-xid",
 ]
@@ -612,52 +605,50 @@ name = "time"
 version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
 dependencies = [
  "libc",
- "wasi 0.10.0+wasi-snapshot-preview1",
+ "wasi",
  "winapi",
 ]
 
 [[package]]
 name = "tokio"
-version = "0.3.6"
+version = "1.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "720ba21c25078711bf456d607987d95bce90f7c3bea5abe1db587862e7a1e87c"
+checksum = "e8190d04c665ea9e6b6a0dc45523ade572c088d2e6566244c1122671dbf4ae3a"
 dependencies = [
  "autocfg",
  "bytes",
- "futures-core",
  "libc",
  "memchr",
  "mio",
  "num_cpus",
  "once_cell",
  "parking_lot",
  "pin-project-lite",
  "signal-hook-registry",
- "slab",
  "tokio-macros",
  "winapi",
 ]
 
 [[package]]
 name = "tokio-macros"
-version = "0.3.1"
+version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "21d30fdbb5dc2d8f91049691aa1a9d4d4ae422a21c334ce8936e5886d30c5c45"
+checksum = "caf7b11a536f46a809a8a9f0bb4237020f70ecbf115b842360afb127ea2fda57"
 dependencies = [
  "proc-macro2",
  "quote",
  "syn",
 ]
 
 [[package]]
 name = "toml"
-version = "0.5.7"
+version = "0.5.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "75cf45bb0bef80604d001caaec0d09da99611b3c0fd39d3080468875cdb65645"
+checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
 dependencies = [
  "serde",
 ]
 
 [[package]]
@@ -688,16 +679,10 @@ checksum = "f7fe0bb3479651439c9112f72b6c505038574c9fbb575ed1bf3b797fa39dd564"
 name = "vec_map"
 version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "f1bddf1187be692e79c5ffeab891132dfb0f236ed36a43c7ed39f1165ee20191"
 
-[[package]]
-name = "wasi"
-version = "0.9.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
-
 [[package]]
 name = "wasi"
 version = "0.10.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
diff --git a/cli/Cargo.toml b/cli/Cargo.toml
index 2c43612..b1953e9 100644
--- a/cli/Cargo.toml
+++ b/cli/Cargo.toml
@@ -6,10 +6,10 @@ edition = "2018"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
 libtdb = {path = "../libtdb"}
-tokio = {version = "0.3.6", features = ["full"]}
-bytes = "0.6.0"
-regex = "1.4.2"
+tokio = {version = "1.2.0", features = ["full"]}
+bytes = "1.0.1"
+regex = "1.4.3"
 lazy_static = "1.4.0"
 clap = {version = "2.33.3", features=["yaml"]}
\ No newline at end of file
diff --git a/libtdb/Cargo.toml b/libtdb/Cargo.toml
index 35a8cfd..7a85dfc 100644
--- a/libtdb/Cargo.toml
+++ b/libtdb/Cargo.toml
@@ -6,7 +6,7 @@ edition = "2018"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
 lazy_static = "1.4.0"
-bytes = "0.6.0"
-termcolor = "1.1.1"
\ No newline at end of file
+bytes = "1.0.1"
+termcolor = "1.1.2"
\ No newline at end of file
diff --git a/server/Cargo.toml b/server/Cargo.toml
index 778a7f6..585612d 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -5,26 +5,26 @@ authors = ["Sayan Nandan <ohsayan@outlook.com>"]
 edition = "2018"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-tokio = { version = "0.3.6", features = ["full"] }
-bytes = "0.6.0"
+tokio = { version = "1.2.0", features = ["full"] }
+bytes = "1.0.1"
 libtdb = {path ="../libtdb"}
 bincode = "1.3.1"
 parking_lot = "0.11.1"
 lazy_static = "1.4.0"
-serde_derive = "1.0.117"
-serde = {version = "1.0.118", features= ["derive"]}
-toml = "0.5.7"
+serde_derive = "1.0.123"
+serde = {version = "1.0.123", features= ["derive"]}
+toml = "0.5.8"
 clap = {version = "2.33.3", features=["yaml"]}
-env_logger = "0.8.2"
-log = "0.4.11"
+env_logger = "0.8.3"
+log = "0.4.14"
 chrono = "0.4.19"
-regex = "1.4.2"
+regex = "1.4.3"
 tdb_macros = {path="../tdb-macros"}
 
 [target.'cfg(not(target_env = "msvc"))'.dependencies]
 jemallocator = "0.3.2"
 
 [dev-dependencies]
-tokio = { version = "0.3.6", features = ["test-util"] }
+tokio = { version = "1.2.0", features = ["test-util"] }
diff --git a/server/src/admin/mksnap.rs b/server/src/admin/mksnap.rs
index 07a8b55..8bc4935 100644
--- a/server/src/admin/mksnap.rs
+++ b/server/src/admin/mksnap.rs
@@ -26,11 +26,11 @@ use crate::diskstore::snapshot::DIR_SNAPSHOT;
 use crate::protocol::{responses, ActionGroup, Connection};
 use crate::resp::GroupBegin;
 use libtdb::terrapipe::RespCodes;
 use libtdb::TResult;
 use std::hint::unreachable_unchecked;
-use std::path::PathBuf;
+use std::path::{Component, PathBuf};
 
 /// Create a snapshot
 ///
 pub async fn mksnap(handle: &CoreDB, con: &mut Connection, act: ActionGroup) -> TResult<()> {
     let howmany = act.howmany();
@@ -104,10 +104,29 @@ pub async fn mksnap(handle: &CoreDB, con: &mut Connection, act: ActionGroup) ->
                 .get(1)
                 .unwrap_or_else(|| unsafe { unreachable_unchecked() });
             let mut path = PathBuf::from(DIR_SNAPSHOT);
             path.push("remote");
             path.push(snapname.to_owned() + ".snapshot");
+            let illegal_snapshot = path
+                .components()
+                .filter(|dir| {
+                    // Sanitize snapshot name, to avoid directory traversal attacks
+                    // If the snapshot name has any root directory or parent directory, then
+                    // we'll allow it to pass through this adaptor.
+                    // As a result, this iterator will give us a count of the 'bad' components
+                    dir == &Component::RootDir || dir == &Component::ParentDir
+                })
+                .count()
+                != 0;
+            if illegal_snapshot {
+                con.write_response(GroupBegin(1)).await?;
+                return con
+                    .write_response(RespCodes::OtherError(Some(
+                        "err-invalid-snapshot-name".to_owned(),
+                    )))
+                    .await;
+            }
             let failed;
             {
                 match diskstore::flush_data(&path, &handle.acquire_read().get_ref()) {
                     Ok(_) => failed = false,
                     Err(e) => {
@@ -129,6 +148,6 @@ pub async fn mksnap(handle: &CoreDB, con: &mut Connection, act: ActionGroup) ->
             return con
                 .write_response(responses::fresp::R_ACTION_ERR.to_owned())
                 .await;
         }
     }
-}
+}
\ No newline at end of file
diff --git a/server/src/cli.yml b/server/src/cli.yml
index 04ba4cd..c936391 100644
--- a/server/src/cli.yml
+++ b/server/src/cli.yml
@@ -17,14 +17,14 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 #
 
-name: TerrabaseDB Server
+name: Skybase Server
 version: 0.5.0
 author: Sayan N. <ohsayan@outlook.com>
-about: The TerrabaseDB Database server
+about: The Skybase Database server
 args:
         - config:
                   short: c
                   required: false
                   long: withconfig
diff --git a/server/src/dbnet.rs b/server/src/dbnet.rs
index 85a9598..507a808 100644
--- a/server/src/dbnet.rs
+++ b/server/src/dbnet.rs
@@ -137,11 +137,11 @@ impl Listener {
     /// Run the server
     pub async fn run(&mut self) -> TResult<()> {
         loop {
             // Take the permit first, but we won't use it right now
             // that's why we will forget it
-            self.climit.acquire().await.forget();
+            self.climit.acquire().await.unwrap().forget();
             let stream = self.accept().await?;
             let mut chandle = CHandler {
                 db: self.db.clone(),
                 con: Connection::new(stream),
                 climit: self.climit.clone(),
diff --git a/server/src/tests/kvengine.rs b/server/src/tests/kvengine.rs
index 037bcb6..3dfed41 100644
--- a/server/src/tests/kvengine.rs
+++ b/server/src/tests/kvengine.rs
@@ -21,12 +21,11 @@
 
 #[tdb_macros::dbtest(skip = "set_values")]
 mod __private {
     use crate::protocol::responses::fresp;
     use libtdb::terrapipe;
-    use tokio::io::AsyncReadExt;
-    use tokio::prelude::*;
+    use tokio::io::{AsyncReadExt, AsyncWriteExt};
     /// Test a HEYA query: The server should return HEY!
     async fn test_heya() {
         let heya = terrapipe::proc_query("HEYA");
         stream.write_all(&heya).await.unwrap();
         let res_should_be = "#2\n*1\n#2\n&1\n+4\nHEY!\n".as_bytes().to_owned();
@@ -80,11 +79,10 @@ mod __private {
         homwany: usize,
         stream: &mut tokio::net::TcpStream,
     ) where
         T: AsRef<str>,
     {
-        use tokio::prelude::*;
         let mut query = String::from("MSET ");
         query.push_str(values_split_with_whitespace.as_ref());
         let count_bytes_len = homwany.to_string().as_bytes().len();
         let q = libtdb::terrapipe::proc_query(query);
         stream.write_all(&q).await.unwrap();
@@ -661,6 +659,23 @@ mod __private {
             .into_bytes();
         let mut response = vec![0; res_should_be.len()];
         stream.read_exact(&mut response).await.unwrap();
         assert_eq!(res_should_be, response);
     }
+    async fn test_mksnap_sanitization() {
+        let res_should_be = "#2\n*1\n#2\n&1\n!25\nerr-invalid-snapshot-name\n"
+            .to_owned()
+            .into_bytes();
+        // First check parent directory syntax
+        let query = terrapipe::proc_query("MKSNAP ../../badsnappy");
+        stream.write_all(&query).await.unwrap();
+        let mut response = vec![0; res_should_be.len()];
+        stream.read_exact(&mut response).await.unwrap();
+        assert_eq!(res_should_be, response);
+        // Now check root directory syntax
+        let query = terrapipe::proc_query("MKSNAP /var/omgcrazysnappy");
+        stream.write_all(&query).await.unwrap();
+        let mut response = vec![0; res_should_be.len()];
+        stream.read_exact(&mut response).await.unwrap();
+        assert_eq!(res_should_be, response);
+    }
 }
diff --git a/tdb-bench/Cargo.toml b/tdb-bench/Cargo.toml
index 92bd630..7c03be2 100644
--- a/tdb-bench/Cargo.toml
+++ b/tdb-bench/Cargo.toml
@@ -5,11 +5,11 @@ authors = ["Sayan Nandan <ohsayan@outlook.com>"]
 edition = "2018"
 
 # See more keys and their definitions at https://doc.rust-lang.org/cargo/reference/manifest.html
 
 [dependencies]
-rand = "0.7.3"
-devtimer = "4.0.0"
+rand = "0.8.3"
+devtimer = "4.0.1"
 libtdb = {path="../libtdb"}
 clap = {version = "2.33.3", features=["yaml"]}
-serde = {version="1.0.118", features=["derive"]}
-serde_json = "1.0.60"
+serde = {version="1.0.123", features=["derive"]}
+serde_json = "1.0.62"
diff --git a/tdb-bench/src/cli.yml b/tdb-bench/src/cli.yml
index ae09dc8..23fe4fb 100644
--- a/tdb-bench/src/cli.yml
+++ b/tdb-bench/src/cli.yml
@@ -17,16 +17,16 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program. If not, see <https://www.gnu.org/licenses/>.
 #
 #
 
-name: TerrabaseDB Benchmark Tool
-version: 0.5.0
+name: Skybase Benchmark Tool
+version: 0.5-hotfix.1
 author: Sayan N. <ohsayan@outlook.com>
 about: |
-        The TerrabaseDB benchmark tool can be used to benchmark TerrabaseDB installations. 
-        If you find any issues, then report one here: https://github.com/terrabasedb/terrabasedb
+        The Skybase benchmark tool can be used to benchmark Skybase installations. 
+        If you find any issues, then report one here: https://github.com/skybasedb/skybase
 args:
         - connections:
                   short: c
                   long: connections
                   value_name: count
diff --git a/tdb-bench/src/main.rs b/tdb-bench/src/main.rs
index cc196dc..1369e0b 100644
--- a/tdb-bench/src/main.rs
+++ b/tdb-bench/src/main.rs
@@ -1,9 +1,9 @@
 /*
  * Created on Sun Sep 13 2020
  *
- * This file is a part of TerrabaseDB
+ * This file is a part of Skybase
  * Copyright (c) 2020, Sayan Nandan <ohsayan at outlook dot com>
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as published by
  * the Free Software Foundation, either version 3 of the License, or
@@ -26,11 +26,11 @@
 mod benchtool {
     use clap::{load_yaml, App};
     use devtimer::DevTime;
     use libtdb::terrapipe;
     use rand::distributions::Alphanumeric;
-    use rand::{thread_rng, Rng};
+    use rand::thread_rng;
     use serde::Serialize;
     use std::io::prelude::*;
     use std::net::{self, TcpStream};
     use std::sync::mpsc;
     use std::sync::Arc;
@@ -165,29 +165,23 @@ mod benchtool {
                     std::process::exit(0x100);
                 }
             },
             None => host.push_str("2003"),
         }
-        let rand = thread_rng();
+        let mut rand = thread_rng();
         if let Some(matches) = matches.subcommand_matches("testkey") {
             let numkeys = matches.value_of("count").unwrap();
             if let Ok(num) = numkeys.parse::<usize>() {
                 let mut np = Netpool::new(10, &host);
                 println!("Generating keys ...");
                 let keys: Vec<String> = (0..num)
                     .into_iter()
-                    .map(|_| {
-                        let rand_string: String = rand.sample_iter(&Alphanumeric).take(8).collect();
-                        rand_string
-                    })
+                    .map(|_| ran_string(8, &mut rand))
                     .collect();
                 let values: Vec<String> = (0..num)
                     .into_iter()
-                    .map(|_| {
-                        let rand_string: String = rand.sample_iter(&Alphanumeric).take(8).collect();
-                        rand_string
-                    })
+                    .map(|_| ran_string(8, &mut rand))
                     .collect();
                 let set_packs: Vec<Vec<u8>> = (0..num)
                     .map(|idx| terrapipe::proc_query(format!("SET {} {}", keys[idx], values[idx])))
                     .collect();
                 set_packs.into_iter().for_each(|packet| {
@@ -223,30 +217,22 @@ mod benchtool {
             "Initializing benchmark\nConnections: {}\nQueries: {}\nData size (key+value): {} bytes",
             max_connections,
             max_queries,
             (packet_size * 2), // key size + value size
         );
-        let rand = thread_rng();
+        let mut rand = thread_rng();
         let mut dt = DevTime::new_complex();
         // Create separate connection pools for get and set operations
         let mut setpool = Netpool::new(max_connections, &host);
         let mut getpool = Netpool::new(max_connections, &host);
         let keys: Vec<String> = (0..max_queries)
             .into_iter()
-            .map(|_| {
-                let rand_string: String =
-                    rand.sample_iter(&Alphanumeric).take(packet_size).collect();
-                rand_string
-            })
+            .map(|_| ran_string(packet_size, &mut rand))
             .collect();
         let values: Vec<String> = (0..max_queries)
             .into_iter()
-            .map(|_| {
-                let rand_string: String =
-                    rand.sample_iter(&Alphanumeric).take(packet_size).collect();
-                rand_string
-            })
+            .map(|_| ran_string(packet_size, &mut rand))
             .collect();
         /*
         We create three vectors of vectors: `set_packs`, `get_packs` and `del_packs`
         The bytes in each of `set_packs` has a query packet for setting data;
         The bytes in each of `get_packs` has a query packet for getting a key set by one of `set_packs`
@@ -307,10 +293,19 @@ mod benchtool {
 
     /// Returns the number of queries/sec
     fn calc(reqs: usize, time: u128) -> f64 {
         reqs as f64 / (time as f64 / 1_000_000_000 as f64)
     }
+
+    fn ran_string(len: usize, rand: impl rand::Rng) -> String {
+        let rand_string: String = rand
+            .sample_iter(&Alphanumeric)
+            .take(len)
+            .map(char::from)
+            .collect();
+        rand_string
+    }
 }
 
 fn main() {
     benchtool::runner();
-}
+}
\ No newline at end of file
diff --git a/tdb-macros/Cargo.toml b/tdb-macros/Cargo.toml
index a44f486..6a27c63 100644
--- a/tdb-macros/Cargo.toml
+++ b/tdb-macros/Cargo.toml
@@ -8,9 +8,9 @@ edition = "2018"
 
 [lib]
 proc-macro = true
 
 [dependencies]
-syn = {version = "1.0.54", features = ["full"]}
-quote = "1.0.7"
-rand = "0.7.3"
+syn = {version = "1.0.60", features = ["full"]}
+quote = "1.0.9"
+rand = "0.8.3"
 proc-macro2 = "1.0.24"
diff --git a/tdb-macros/src/lib.rs b/tdb-macros/src/lib.rs
index 14eb372..58e48e0 100644
--- a/tdb-macros/src/lib.rs
+++ b/tdb-macros/src/lib.rs
@@ -65,11 +65,11 @@ fn parse_dbtest(mut input: syn::ItemFn, rand: u16) -> Result<TokenStream, syn::E
             None
         ).unwrap();
         let addr = crate::tests::start_test_server(#rand, Some(asyncdb.clone())).await;
         let mut stream = tokio::net::TcpStream::connect(&addr).await.unwrap();
         #body
-        stream.shutdown(::std::net::Shutdown::Write).unwrap();
+        stream.shutdown().await.unwrap();
         asyncdb.finish_db();
         drop(asyncdb);
     };
     let result = quote! {
         #header
@@ -181,23 +181,23 @@ fn parse_test_module(args: TokenStream, item: TokenStream) -> TokenStream {
         we will set the limit to (1024, 65535)
         However, for Windows, several ports in the range [49670, 50293] and ports {5357, 7680} are taken
         over by Hyper-V, which is why we'll prevent attempts to bind to them, if
         the OS is Windows.
         */
-        let mut rand: u16 = rng.gen_range(1025, 65535);
+        let mut rand: u16 = rng.gen_range(1025..=65535);
         #[cfg(not(target_os = "windows"))]
         {
             while in_set.contains(&rand) {
-                rand = rng.gen_range(1025, 65535);
+                rand = rng.gen_range(1025..=65535);
             }
         }
         #[cfg(target_os = "windows")]
         {
             in_set.insert(5357);
             in_set.insert(7680);
             while in_set.contains(&rand) || (rand >= 49670 && rand <= 50293) {
-                rand = rng.gen_range(1025, 65535);
+                rand = rng.gen_range(1025..=65535);
             }
         }
         in_set.insert(rand);
         match item {
             // We just care about functions, so parse functions and ignore everything

Vulnerable code: snapstore.partmap
version = "0.6.0"
checksum = "e0dcbc35f504eb6fc275a6d20e4ebcda18cf50d40ba6fabff8c711fa16cb3b16"
version = "4.0.0"
checksum = "6035b7b9244bf9637cd7ef80b5e1c54404bef92cccd34738c85c45f04ae8b244"
version = "0.8.2"
checksum = "f26ecb66b4bdca6c1409b40fb255eefc2bd4f6d135dab3c3124f80ffa2a9661e"
[[package]]
name = "futures-core"
version = "0.3.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "59f5fff90fd5d971f936ad674802482ba441b6f09ba5e15fd8b39145582ca399"

version = "0.1.15"
checksum = "fc587bc0ec293155d5bfa6b9891ec18a1e330c234f896ea47fbada4cadbe47e6"
 "cfg-if",
 "wasi 0.9.0+wasi-snapshot-preview1",
version = "0.4.11"
checksum = "4fabed175da42fed1fa0746b0ea71f412aa9d35e76e95e59b192c64b9dc2bf8b"
 "cfg-if",
 "cfg-if",
version = "1.0.7"
checksum = "aa563d17ecb180e500da1cfd2b028310ac758de548efdd203e18f283af693f37"
version = "0.7.3"
checksum = "6a6b1679d49b24bbfe0c803429aa1874472f50d9b363131f0e89fc356b544d03"
 "getrandom",
version = "0.2.2"
checksum = "f4c8ed856279c9737206bf725bf36935d8666ead7aa69b52be55af369d193402"
version = "0.5.1"
checksum = "90bde5296fc891b0cef12a6d03ddccc162ce7b2aff54160af9338f8d40df6d19"
version = "0.2.0"
checksum = "ca3129af7b92a17112d59ad498c6f81eaf463253766b90396d39ea7a39d6613c"
version = "1.4.2"
checksum = "38cf2c13ed4745de91a5eb834e11c00bcc3709e773173b2ce4c56c9fbde04b9c"
version = "0.6.21"
checksum = "3b181ba2dcf07aaccad5448e8ead58db5b742cf85dfe035e2227f137a539a189"
version = "1.0.118"
checksum = "06c64263859d87aa2eb554587e2d23183398d617427327cf2b3d0ed8c69e4800"
version = "1.0.118"
checksum = "c84d3526699cd55261af4b941e4e725444df67aa4f9e6a3564f18030d12672df"
version = "1.0.60"
checksum = "1500e84d27fe482ed1dc791a56eddc2f230046a040fa908c08bda1d9fb615779"
[[package]]
name = "slab"
version = "0.4.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c111b5bd5695e56cffe5129854aa230b39c93a305372fdbb2668ca2394eea9f8"

 "cfg-if",
version = "1.0.54"
checksum = "9a2af957a63d6bd42255c359c93d9bfdb97076bd3b820897ce55ffbfbf107f44"
 "wasi 0.10.0+wasi-snapshot-preview1",
version = "0.3.6"
checksum = "720ba21c25078711bf456d607987d95bce90f7c3bea5abe1db587862e7a1e87c"
 "futures-core",
 "slab",
version = "0.3.1"
checksum = "21d30fdbb5dc2d8f91049691aa1a9d4d4ae422a21c334ce8936e5886d30c5c45"
version = "0.5.7"
checksum = "75cf45bb0bef80604d001caaec0d09da99611b3c0fd39d3080468875cdb65645"
[[package]]
name = "wasi"
version = "0.9.0+wasi-snapshot-preview1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"

tokio = {version = "0.3.6", features = ["full"]}
bytes = "0.6.0"
regex = "1.4.2"
bytes = "0.6.0"
termcolor = "1.1.1"
tokio = { version = "0.3.6", features = ["full"] }
bytes = "0.6.0"
serde_derive = "1.0.117"
serde = {version = "1.0.118", features= ["derive"]}
toml = "0.5.7"
env_logger = "0.8.2"
log = "0.4.11"
regex = "1.4.2"
tokio = { version = "0.3.6", features = ["test-util"] }
use std::path::PathBuf;
}
name: TerrabaseDB Server
about: The TerrabaseDB Database server
            self.climit.acquire().await.forget();
    use tokio::io::AsyncReadExt;
    use tokio::prelude::*;
        use tokio::prelude::*;
rand = "0.7.3"
devtimer = "4.0.0"
serde = {version="1.0.118", features=["derive"]}
serde_json = "1.0.60"
name: TerrabaseDB Benchmark Tool
version: 0.5.0
        The TerrabaseDB benchmark tool can be used to benchmark TerrabaseDB installations. 
        If you find any issues, then report one here: https://github.com/terrabasedb/terrabasedb
 * This file is a part of TerrabaseDB
    use rand::{thread_rng, Rng};
        let rand = thread_rng();
                    .map(|_| {
                        let rand_string: String = rand.sample_iter(&Alphanumeric).take(8).collect();
                        rand_string
                    })
                    .map(|_| {
                        let rand_string: String = rand.sample_iter(&Alphanumeric).take(8).collect();
                        rand_string
                    })
        let rand = thread_rng();
            .map(|_| {
                let rand_string: String =
                    rand.sample_iter(&Alphanumeric).take(packet_size).collect();
                rand_string
            })
            .map(|_| {
                let rand_string: String =
                    rand.sample_iter(&Alphanumeric).take(packet_size).collect();
                rand_string
            })
}
syn = {version = "1.0.54", features = ["full"]}
quote = "1.0.7"
rand = "0.7.3"
        stream.shutdown(::std::net::Shutdown::Write).unwrap();
        let mut rand: u16 = rng.gen_range(1025, 65535);
                rand = rng.gen_range(1025, 65535);
                rand = rng.gen_range(1025, 65535);
Fixed code: snapstore.partmap
/snapshots 
<?xml version="1.0" encoding="UTF-8"?>
<project version="4">
  <component name="CMakeRunConfigurationManager" shouldGenerate="true" shouldDeleteObsolete="true">
    <generated />
  </component>
  <component name="CMakeSettings">
    <configurations>
      <configuration PROFILE_NAME="Debug" CONFIG_NAME="Debug" ENABLED="true" />
    </configurations>
  </component>
  <component name="CargoProjects">
    <cargoProject FILE="$PROJECT_DIR$/Cargo.toml" />
  </component>
  <component name="ChangeListManager">
    <list default="true" id="05446e12-25fb-4f56-ae52-664b69a61212" name="Default Changelist" comment="">
      <change beforePath="$PROJECT_DIR$/server/src/main.rs" beforeDir="false" afterPath="$PROJECT_DIR$/server/src/main.rs" afterDir="false" />
    </list>
    <option name="SHOW_DIALOG" value="false" />
    <option name="HIGHLIGHT_CONFLICTS" value="true" />
    <option name="HIGHLIGHT_NON_ACTIVE_CHANGELIST" value="false" />
    <option name="LAST_RESOLUTION" value="IGNORE" />
  </component>
  <component name="ClangdSettings">
    <option name="formatViaClangd" value="false" />
  </component>
  <component name="Git.Settings">
    <option name="RECENT_GIT_ROOT_PATH" value="$PROJECT_DIR$" />
  </component>
  <component name="GitSEFilterConfiguration">
    <file-type-list>
      <filtered-out-file-type name="LOCAL_BRANCH" />
      <filtered-out-file-type name="REMOTE_BRANCH" />
      <filtered-out-file-type name="TAG" />
      <filtered-out-file-type name="COMMIT_BY_MESSAGE" />
    </file-type-list>
  </component>
  <component name="MacroExpansionManager">
    <option name="directoryName" value="k3yyr5y2" />
  </component>
  <component name="ProjectId" id="1mjP2LZbFlEc2swjliVmxauGK9Q" />
  <component name="ProjectLevelVcsManager" settingsEditedManually="true" />
  <component name="ProjectViewState">
    <option name="hideEmptyMiddlePackages" value="true" />
    <option name="showLibraryContents" value="true" />
    <option name="showVisibilityIcons" value="true" />
  </component>
  <component name="PropertiesComponent">
    <property name="RunOnceActivity.OpenProjectViewOnStart" value="true" />
    <property name="RunOnceActivity.ShowReadmeOnStart" value="true" />
    <property name="WebServerToolWindowFactoryState" value="false" />
    <property name="cf.first.check.clang-format" value="false" />
    <property name="last_opened_file_path" value="$PROJECT_DIR$" />
    <property name="nodejs_package_manager_path" value="npm" />
    <property name="org.rust.cargo.project.model.PROJECT_DISCOVERY" value="true" />
  </component>
  <component name="RustProjectSettings">
    <option name="toolchainHomeDirectory" value="$USER_HOME$/.cargo/bin" />
  </component>
  <component name="SpellCheckerSettings" RuntimeDictionaries="0" Folders="0" CustomDictionaries="0" DefaultDictionary="application-level" UseSingleDictionary="true" transferred="true" />
  <component name="TaskManager">
    <task active="true" id="Default" summary="Default task">
      <changelist id="05446e12-25fb-4f56-ae52-664b69a61212" name="Default Changelist" comment="" />
      <created>1610003825159</created>
      <option name="number" value="Default" />
      <option name="presentableId" value="Default" />
      <updated>1610003825159</updated>
      <workItem from="1610003832233" duration="85000" />
      <workItem from="1610003959549" duration="724000" />
    </task>
    <servers />
  </component>
  <component name="TypeScriptGeneratedFilesManager">
    <option name="version" value="3" />
  </component>
</project>
version = "1.0.1"
checksum = "b700ce4376041dcd0a327fd0097c41095743c4c8af8887265942faf1100bd040"
[[package]]
name = "cfg-if"
version = "1.0.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"

version = "4.0.1"
checksum = "907339959a92f6b98846570500c0a567c9aecbb3871cef00561eb5d20d47b7c1"
version = "0.8.3"
checksum = "17392a012ea30ef05a610aa97dfb49496e71c9f676b27879922ea5bdf60d9d3f"
version = "0.2.2"
checksum = "c9495705279e7140bf035dde1f6e750c162df8b625267cd52cc44e0b156732c8"
 "cfg-if 1.0.0",
 "wasi",
version = "0.4.14"
checksum = "51b9bbe6c47d51fc3e1a9b945965946b4c44142ab8792c50835a980d362c2710"
 "cfg-if 1.0.0",
 "cfg-if 0.1.10",
version = "1.0.9"
checksum = "c3d0b9745dc2debf507c8422de05d7226cc1f0644216dfdfead988f9b1ab32a7"
version = "0.8.3"
checksum = "0ef9e7e66b4468674bfcb0c81af8b7fa0bb154fa9f28eb840da5c447baeb8d7e"
version = "0.3.0"
checksum = "e12735cf05c9e10bf21534da50a147b924d555dc7a547c42e6bb2d5b6017ae0d"
version = "0.6.2"
checksum = "34cf66eb183df1c5876e2dcf6b13d57340741e8dc255b48e40a26de954d06ae7"
version = "0.3.0"
checksum = "3190ef7066a446f2e7f42e239d161e905420ccab01eb967c9eb27d21b2322a73"
version = "1.4.3"
checksum = "d9251239e129e16308e70d853559389de218ac275b515068abc96829d05b948a"
version = "0.6.22"
checksum = "b5eb417147ba9860a96cfe72a0b93bf88fee1744b5636ec99ab20c1aa9376581"
version = "1.0.123"
checksum = "92d5161132722baa40d802cc70b15262b98258453e85e5d1d365c757c73869ae"
version = "1.0.123"
checksum = "9391c295d64fc0abb2c556bad848f33cb8296276b1ad2677d1ae1ace4f258f31"
version = "1.0.62"
checksum = "ea1c6153794552ea7cf7cf63b1231a25de00ec90db326ba6264440fa08e31486"
 "cfg-if 0.1.10",
version = "1.0.60"
checksum = "c700597eca8a5a762beb35753ef6b94df201c81cca676604f547495a0d7f0081"
 "wasi",
version = "1.2.0"
checksum = "e8190d04c665ea9e6b6a0dc45523ade572c088d2e6566244c1122671dbf4ae3a"
version = "1.1.0"
checksum = "caf7b11a536f46a809a8a9f0bb4237020f70ecbf115b842360afb127ea2fda57"
version = "0.5.8"
checksum = "a31142970826733df8241ef35dc040ef98c679ab14d7c3e54d827099b3acecaa"
tokio = {version = "1.2.0", features = ["full"]}
bytes = "1.0.1"
regex = "1.4.3"
bytes = "1.0.1"
termcolor = "1.1.2"
tokio = { version = "1.2.0", features = ["full"] }
bytes = "1.0.1"
serde_derive = "1.0.123"
serde = {version = "1.0.123", features= ["derive"]}
toml = "0.5.8"
env_logger = "0.8.3"
log = "0.4.14"
regex = "1.4.3"
tokio = { version = "1.2.0", features = ["test-util"] }
use std::path::{Component, PathBuf};
            let illegal_snapshot = path
                .components()
                .filter(|dir| {
                    // Sanitize snapshot name, to avoid directory traversal attacks
                    // If the snapshot name has any root directory or parent directory, then
                    // we'll allow it to pass through this adaptor.
                    // As a result, this iterator will give us a count of the 'bad' components
                    dir == &Component::RootDir || dir == &Component::ParentDir
                })
                .count()
                != 0;
            if illegal_snapshot {
                con.write_response(GroupBegin(1)).await?;
                return con
                    .write_response(RespCodes::OtherError(Some(
                        "err-invalid-snapshot-name".to_owned(),
                    )))
                    .await;
            }
}
name: Skybase Server
about: The Skybase Database server
            self.climit.acquire().await.unwrap().forget();
    use tokio::io::{AsyncReadExt, AsyncWriteExt};
    async fn test_mksnap_sanitization() {
        let res_should_be = "#2\n*1\n#2\n&1\n!25\nerr-invalid-snapshot-name\n"
            .to_owned()
            .into_bytes();
        // First check parent directory syntax
        let query = terrapipe::proc_query("MKSNAP ../../badsnappy");
        stream.write_all(&query).await.unwrap();
        let mut response = vec![0; res_should_be.len()];
        stream.read_exact(&mut response).await.unwrap();
        assert_eq!(res_should_be, response);
        // Now check root directory syntax
        let query = terrapipe::proc_query("MKSNAP /var/omgcrazysnappy");
        stream.write_all(&query).await.unwrap();
        let mut response = vec![0; res_should_be.len()];
        stream.read_exact(&mut response).await.unwrap();
        assert_eq!(res_should_be, response);
    }
rand = "0.8.3"
devtimer = "4.0.1"
serde = {version="1.0.123", features=["derive"]}
serde_json = "1.0.62"
name: Skybase Benchmark Tool
version: 0.5-hotfix.1
        The Skybase benchmark tool can be used to benchmark Skybase installations. 
        If you find any issues, then report one here: https://github.com/skybasedb/skybase
 * This file is a part of Skybase
    use rand::thread_rng;
        let mut rand = thread_rng();
                    .map(|_| ran_string(8, &mut rand))
                    .map(|_| ran_string(8, &mut rand))
        let mut rand = thread_rng();
            .map(|_| ran_string(packet_size, &mut rand))
            .map(|_| ran_string(packet_size, &mut rand))

    fn ran_string(len: usize, rand: impl rand::Rng) -> String {
        let rand_string: String = rand
            .sample_iter(&Alphanumeric)
            .take(len)
            .map(char::from)
            .collect();
        rand_string
    }
}
syn = {version = "1.0.60", features = ["full"]}
quote = "1.0.9"
rand = "0.8.3"
        stream.shutdown().await.unwrap();
        let mut rand: u16 = rng.gen_range(1025..=65535);
                rand = rng.gen_range(1025..=65535);
                rand = rng.gen_range(1025..=65535);