Repository: seanmonstar/warp (language: rust)

Issue:
CVE-2023-43669/GHSA-9mcr-873m-xcxp: tungstenite <= 0.20.0 DoS vulnerability
Hi!

I've noticed a security warning in one of my github repositories related to tungstenite:

https://github.com/snapview/tungstenite-rs/issues/376

This is due to warp depending on tokio-tungstenite 0.18.0, which in turn depends on tungstenite 0.18.0.

To fix this, the tokio-tungstenite dependency needs to be updated to 0.20.1.


Discussion / hints:

Fix patch:
diff --git a/Cargo.toml b/Cargo.toml
index 002de45d2..e7533895d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -37,7 +37,7 @@ tokio-stream = "0.1.1"
 tokio-util = { version = "0.7", features = ["io"] }
 tracing = { version = "0.1.21", default-features = false, features = ["log", "std"] }
 tower-service = "0.3"
-tokio-tungstenite = { version = "0.18", optional = true }
+tokio-tungstenite = { version = "0.20", optional = true }
 percent-encoding = "2.1"
 pin-project = "1.0"
 tokio-rustls = { version = "0.24", optional = true }
diff --git a/src/filters/ws.rs b/src/filters/ws.rs
index e5ae62c43..81a6273cb 100644
--- a/src/filters/ws.rs
+++ b/src/filters/ws.rs
@@ -92,11 +92,21 @@ impl Ws {
 
     // config
 
-    /// Set the size of the internal message send queue.
-    pub fn max_send_queue(mut self, max: usize) -> Self {
+    /// Does nothing.
+    ///
+    /// # Deprecated
+    ///
+    /// Use `max_write_buffer_size()` instead.
+    #[deprecated = "use max_write_buffer_size instead"]
+    pub fn max_send_queue(self, _max: usize) -> Self {
+        self
+    }
+
+    /// The max size of the write buffer, in bytes.
+    pub fn max_write_buffer_size(mut self, max: usize) -> Self {
         self.config
             .get_or_insert_with(WebSocketConfig::default)
-            .max_send_queue = Some(max);
+            .max_write_buffer_size = max;
         self
     }
 


Test patch: