Repository: rinja-rs/askama (language: rust)

Issue:
Release new `askama_axum`? Existing latest release doesn't pass "cargo audit".
Our project fails `cargo audit` due to:

```
       > Version:       0.1.2
       > Title:         No default limit put on request bodies
       > Date:          2022-08-31
       > ID:            RUSTSEC-2022-0055
       > URL:           https://rustsec.org/advisories/RUSTSEC-2022-0055
       > Solution:      Upgrade to >=0.2.8, <0.3.0-rc.1 OR >=0.3.0-rc.2
       > Dependency tree:
       > axum-core 0.1.2
       >
       > error: 1 vulnerability found!
```

and `askama_axum` is pulling in this dependency. I see that the version in `git` already points to `axum-core = "0.2"`, so that would help, but needs a release.

Thanks!


Discussion / hints:

Fix patch:
diff --git a/askama_axum/Cargo.toml b/askama_axum/Cargo.toml
index b972626c6..834daf4b8 100644
--- a/askama_axum/Cargo.toml
+++ b/askama_axum/Cargo.toml
@@ -14,12 +14,11 @@ readme = "README.md"
 
 [dependencies]
 askama = { version = "0.11.0", path = "../askama", default-features = false, features = ["with-axum", "mime", "mime_guess"] }
-axum-core = "0.1"
+axum-core = "0.2"
 http = "0.2"
-http-body = "0.4"
 
 [dev-dependencies]
-axum = { version = "0.4", default-features = false }
+axum = { version = "0.5", default-features = false }
 hyper = { version = "0.14", features = ["full"] }
 tokio = { version = "1.0", features = ["full"] }
 tower = { version = "0.4", features = ["util"] }
diff --git a/askama_axum/src/lib.rs b/askama_axum/src/lib.rs
index 104867499..da3d69902 100644
--- a/askama_axum/src/lib.rs
+++ b/askama_axum/src/lib.rs
@@ -3,26 +3,19 @@
 #![deny(unreachable_pub)]
 
 pub use askama::*;
-use axum_core::body;
-pub use axum_core::body::BoxBody;
-pub use axum_core::response::IntoResponse;
-pub use http::Response;
+pub use axum_core::response::{IntoResponse, Response};
 use http::StatusCode;
-use http_body::{Empty, Full};
 
-pub fn into_response<T: Template>(t: &T, _ext: &str) -> Response<BoxBody> {
+pub fn into_response<T: Template>(t: &T, _ext: &str) -> Response {
     match t.render() {
-        Ok(body) => Response::builder()
-            .status(StatusCode::OK)
-            .header(
+        Ok(body) => {
+            let headers = [(
                 http::header::CONTENT_TYPE,
                 http::HeaderValue::from_static(T::MIME_TYPE),
-            )
-            .body(body::boxed(Full::from(body)))
-            .unwrap(),
-        Err(_) => Response::builder()
-            .status(StatusCode::INTERNAL_SERVER_ERROR)
-            .body(body::boxed(Empty::new()))
-            .unwrap(),
+            )];
+
+            (headers, body).into_response()
+        }
+        Err(_) => StatusCode::INTERNAL_SERVER_ERROR.into_response(),
     }
 }
diff --git a/askama_shared/src/filters/json.rs b/askama_shared/src/filters/json.rs
index e94e50c1b..6afdd52c3 100644
--- a/askama_shared/src/filters/json.rs
+++ b/askama_shared/src/filters/json.rs
@@ -28,6 +28,7 @@ mod tests {
     use super::*;
 
     #[test]
+    #[allow(clippy::needless_borrow)]
     fn test_json() {
         assert_eq!(json(true).unwrap(), "true");
         assert_eq!(json("foo").unwrap(), r#""foo""#);
diff --git a/askama_shared/src/filters/mod.rs b/askama_shared/src/filters/mod.rs
index 9fb10d2fe..4d58da606 100644
--- a/askama_shared/src/filters/mod.rs
+++ b/askama_shared/src/filters/mod.rs
@@ -5,7 +5,7 @@
 //! For more information, read the [book](https://djc.github.io/askama/filters.html).
 #![allow(clippy::trivially_copy_pass_by_ref)]
 
-use std::fmt;
+use std::fmt::{self, Write};
 
 #[cfg(feature = "serde_json")]
 mod json;
@@ -313,7 +313,7 @@ where
             rv.push_str(separator);
         }
 
-        rv.push_str(&format!("{}", item));
+        write!(rv, "{}", item)?;
     }
 
     Ok(rv)
@@ -450,61 +450,61 @@ mod tests {
     fn test_urlencoding() {
         // Unreserved (https://tools.ietf.org/html/rfc3986.html#section-2.3)
         // alpha / digit
-        assert_eq!(urlencode(&"AZaz09").unwrap(), "AZaz09");
-        assert_eq!(urlencode_strict(&"AZaz09").unwrap(), "AZaz09");
+        assert_eq!(urlencode("AZaz09").unwrap(), "AZaz09");
+        assert_eq!(urlencode_strict("AZaz09").unwrap(), "AZaz09");
         // other
-        assert_eq!(urlencode(&"_.-~").unwrap(), "_.-~");
-        assert_eq!(urlencode_strict(&"_.-~").unwrap(), "_.-~");
+        assert_eq!(urlencode("_.-~").unwrap(), "_.-~");
+        assert_eq!(urlencode_strict("_.-~").unwrap(), "_.-~");
 
         // Reserved (https://tools.ietf.org/html/rfc3986.html#section-2.2)
         // gen-delims
-        assert_eq!(urlencode(&":/?#[]@").unwrap(), "%3A/%3F%23%5B%5D%40");
+        assert_eq!(urlencode(":/?#[]@").unwrap(), "%3A/%3F%23%5B%5D%40");
         assert_eq!(
-            urlencode_strict(&":/?#[]@").unwrap(),
+            urlencode_strict(":/?#[]@").unwrap(),
             "%3A%2F%3F%23%5B%5D%40"
         );
         // sub-delims
         assert_eq!(
-            urlencode(&"!$&'()*+,;=").unwrap(),
+            urlencode("!$&'()*+,;=").unwrap(),
             "%21%24%26%27%28%29%2A%2B%2C%3B%3D"
         );
         assert_eq!(
-            urlencode_strict(&"!$&'()*+,;=").unwrap(),
+            urlencode_strict("!$&'()*+,;=").unwrap(),
             "%21%24%26%27%28%29%2A%2B%2C%3B%3D"
         );
 
         // Other
         assert_eq!(
-            urlencode(&"žŠďŤňĚáÉóŮ").unwrap(),
+            urlencode("žŠďŤňĚáÉóŮ").unwrap(),
             "%C5%BE%C5%A0%C4%8F%C5%A4%C5%88%C4%9A%C3%A1%C3%89%C3%B3%C5%AE"
         );
         assert_eq!(
-            urlencode_strict(&"žŠďŤňĚáÉóŮ").unwrap(),
+            urlencode_strict("žŠďŤňĚáÉóŮ").unwrap(),
             "%C5%BE%C5%A0%C4%8F%C5%A4%C5%88%C4%9A%C3%A1%C3%89%C3%B3%C5%AE"
         );
 
         // Ferris
-        assert_eq!(urlencode(&"🦀").unwrap(), "%F0%9F%A6%80");
-        assert_eq!(urlencode_strict(&"🦀").unwrap(), "%F0%9F%A6%80");
+        assert_eq!(urlencode("🦀").unwrap(), "%F0%9F%A6%80");
+        assert_eq!(urlencode_strict("🦀").unwrap(), "%F0%9F%A6%80");
     }
 
     #[test]
     fn test_linebreaks() {
         assert_eq!(
-            linebreaks(&"Foo\nBar Baz").unwrap(),
+            linebreaks("Foo\nBar Baz").unwrap(),
             "<p>Foo<br/>Bar Baz</p>"
         );
         assert_eq!(
-            linebreaks(&"Foo\nBar\n\nBaz").unwrap(),
+            linebreaks("Foo\nBar\n\nBaz").unwrap(),
             "<p>Foo<br/>Bar</p><p>Baz</p>"
         );
     }
 
     #[test]
     fn test_linebreaksbr() {
-        assert_eq!(linebreaksbr(&"Foo\nBar").unwrap(), "Foo<br/>Bar");
+        assert_eq!(linebreaksbr("Foo\nBar").unwrap(), "Foo<br/>Bar");
         assert_eq!(
-            linebreaksbr(&"Foo\nBar\n\nBaz").unwrap(),
+            linebreaksbr("Foo\nBar\n\nBaz").unwrap(),
             "Foo<br/>Bar<br/><br/>Baz"
         );
     }
@@ -512,72 +512,72 @@ mod tests {
     #[test]
     fn test_paragraphbreaks() {
         assert_eq!(
-            paragraphbreaks(&"Foo\nBar Baz").unwrap(),
+            paragraphbreaks("Foo\nBar Baz").unwrap(),
             "<p>Foo\nBar Baz</p>"
         );
         assert_eq!(
-            paragraphbreaks(&"Foo\nBar\n\nBaz").unwrap(),
+            paragraphbreaks("Foo\nBar\n\nBaz").unwrap(),
             "<p>Foo\nBar</p><p>Baz</p>"
         );
         assert_eq!(
-            paragraphbreaks(&"Foo\n\n\n\n\nBar\n\nBaz").unwrap(),
+            paragraphbreaks("Foo\n\n\n\n\nBar\n\nBaz").unwrap(),
             "<p>Foo</p><p>\nBar</p><p>Baz</p>"
         );
     }
 
     #[test]
     fn test_lower() {
-        assert_eq!(lower(&"Foo").unwrap(), "foo");
-        assert_eq!(lower(&"FOO").unwrap(), "foo");
-        assert_eq!(lower(&"FooBar").unwrap(), "foobar");
-        assert_eq!(lower(&"foo").unwrap(), "foo");
+        assert_eq!(lower("Foo").unwrap(), "foo");
+        assert_eq!(lower("FOO").unwrap(), "foo");
+        assert_eq!(lower("FooBar").unwrap(), "foobar");
+        assert_eq!(lower("foo").unwrap(), "foo");
     }
 
     #[test]
     fn test_upper() {
-        assert_eq!(upper(&"Foo").unwrap(), "FOO");
-        assert_eq!(upper(&"FOO").unwrap(), "FOO");
-        assert_eq!(upper(&"FooBar").unwrap(), "FOOBAR");
-        assert_eq!(upper(&"foo").unwrap(), "FOO");
+        assert_eq!(upper("Foo").unwrap(), "FOO");
+        assert_eq!(upper("FOO").unwrap(), "FOO");
+        assert_eq!(upper("FooBar").unwrap(), "FOOBAR");
+        assert_eq!(upper("foo").unwrap(), "FOO");
     }
 
     #[test]
     fn test_trim() {
-        assert_eq!(trim(&" Hello\tworld\t").unwrap(), "Hello\tworld");
+        assert_eq!(trim(" Hello\tworld\t").unwrap(), "Hello\tworld");
     }
 
     #[test]
     fn test_truncate() {
-        assert_eq!(truncate(&"hello", 2).unwrap(), "he...");
+        assert_eq!(truncate("hello", 2).unwrap(), "he...");
         let a = String::from("您好");
         assert_eq!(a.len(), 6);
         assert_eq!(String::from("您").len(), 3);
-        assert_eq!(truncate(&"您好", 1).unwrap(), "您...");
-        assert_eq!(truncate(&"您好", 2).unwrap(), "您...");
-        assert_eq!(truncate(&"您好", 3).unwrap(), "您...");
-        assert_eq!(truncate(&"您好", 4).unwrap(), "您好...");
-        assert_eq!(truncate(&"您好", 6).unwrap(), "您好");
-        assert_eq!(truncate(&"您好", 7).unwrap(), "您好");
+        assert_eq!(truncate("您好", 1).unwrap(), "您...");
+        assert_eq!(truncate("您好", 2).unwrap(), "您...");
+        assert_eq!(truncate("您好", 3).unwrap(), "您...");
+        assert_eq!(truncate("您好", 4).unwrap(), "您好...");
+        assert_eq!(truncate("您好", 6).unwrap(), "您好");
+        assert_eq!(truncate("您好", 7).unwrap(), "您好");
         let s = String::from("🤚a🤚");
         assert_eq!(s.len(), 9);
         assert_eq!(String::from("🤚").len(), 4);
-        assert_eq!(truncate(&"🤚a🤚", 1).unwrap(), "🤚...");
-        assert_eq!(truncate(&"🤚a🤚", 2).unwrap(), "🤚...");
-        assert_eq!(truncate(&"🤚a🤚", 3).unwrap(), "🤚...");
-        assert_eq!(truncate(&"🤚a🤚", 4).unwrap(), "🤚...");
-        assert_eq!(truncate(&"🤚a🤚", 5).unwrap(), "🤚a...");
-        assert_eq!(truncate(&"🤚a🤚", 6).unwrap(), "🤚a🤚...");
-        assert_eq!(truncate(&"🤚a🤚", 9).unwrap(), "🤚a🤚");
-        assert_eq!(truncate(&"🤚a🤚", 10).unwrap(), "🤚a🤚");
+        assert_eq!(truncate("🤚a🤚", 1).unwrap(), "🤚...");
+        assert_eq!(truncate("🤚a🤚", 2).unwrap(), "🤚...");
+        assert_eq!(truncate("🤚a🤚", 3).unwrap(), "🤚...");
+        assert_eq!(truncate("🤚a🤚", 4).unwrap(), "🤚...");
+        assert_eq!(truncate("🤚a🤚", 5).unwrap(), "🤚a...");
+        assert_eq!(truncate("🤚a🤚", 6).unwrap(), "🤚a🤚...");
+        assert_eq!(truncate("🤚a🤚", 9).unwrap(), "🤚a🤚");
+        assert_eq!(truncate("🤚a🤚", 10).unwrap(), "🤚a🤚");
     }
 
     #[test]
     fn test_indent() {
-        assert_eq!(indent(&"hello", 2).unwrap(), "hello");
-        assert_eq!(indent(&"hello\n", 2).unwrap(), "hello\n");
-        assert_eq!(indent(&"hello\nfoo", 2).unwrap(), "hello\n  foo");
+        assert_eq!(indent("hello", 2).unwrap(), "hello");
+        assert_eq!(indent("hello\n", 2).unwrap(), "hello\n");
+        assert_eq!(indent("hello\nfoo", 2).unwrap(), "hello\n  foo");
         assert_eq!(
-            indent(&"hello\nfoo\n bar", 4).unwrap(),
+            indent("hello\nfoo\n bar", 4).unwrap(),
             "hello\n    foo\n     bar"
         );
     }
@@ -649,12 +649,12 @@ mod tests {
 
     #[test]
     fn test_capitalize() {
-        assert_eq!(capitalize(&"foo").unwrap(), "Foo".to_string());
-        assert_eq!(capitalize(&"f").unwrap(), "F".to_string());
-        assert_eq!(capitalize(&"fO").unwrap(), "Fo".to_string());
-        assert_eq!(capitalize(&"").unwrap(), "".to_string());
-        assert_eq!(capitalize(&"FoO").unwrap(), "Foo".to_string());
-        assert_eq!(capitalize(&"foO BAR").unwrap(), "Foo bar".to_string());
+        assert_eq!(capitalize("foo").unwrap(), "Foo".to_string());
+        assert_eq!(capitalize("f").unwrap(), "F".to_string());
+        assert_eq!(capitalize("fO").unwrap(), "Fo".to_string());
+        assert_eq!(capitalize("").unwrap(), "".to_string());
+        assert_eq!(capitalize("FoO").unwrap(), "Foo".to_string());
+        assert_eq!(capitalize("foO BAR").unwrap(), "Foo bar".to_string());
     }
 
     #[test]
@@ -667,9 +667,9 @@ mod tests {
 
     #[test]
     fn test_wordcount() {
-        assert_eq!(wordcount(&"").unwrap(), 0);
-        assert_eq!(wordcount(&" \n\t").unwrap(), 0);
-        assert_eq!(wordcount(&"foo").unwrap(), 1);
-        assert_eq!(wordcount(&"foo bar").unwrap(), 2);
+        assert_eq!(wordcount("").unwrap(), 0);
+        assert_eq!(wordcount(" \n\t").unwrap(), 0);
+        assert_eq!(wordcount("foo").unwrap(), 1);
+        assert_eq!(wordcount("foo bar").unwrap(), 2);
     }
 }
diff --git a/askama_shared/src/filters/yaml.rs b/askama_shared/src/filters/yaml.rs
index d71e6303e..890f43579 100644
--- a/askama_shared/src/filters/yaml.rs
+++ b/askama_shared/src/filters/yaml.rs
@@ -21,6 +21,7 @@ mod tests {
     use askama_escape::Html;
 
     #[test]
+    #[allow(clippy::needless_borrow)]
     fn test_yaml() {
         assert_eq!(yaml(Html, true).unwrap().to_string(), "---\ntrue");
         assert_eq!(yaml(Html, "foo").unwrap().to_string(), "---\nfoo");
diff --git a/askama_shared/src/generator.rs b/askama_shared/src/generator.rs
index 99971392d..523f009a6 100644
--- a/askama_shared/src/generator.rs
+++ b/askama_shared/src/generator.rs
@@ -219,10 +219,7 @@ impl<'a, S: std::hash::BuildHasher> Generator<'a, S> {
     fn impl_axum_into_response(&mut self, buf: &mut Buffer) -> Result<(), CompileError> {
         self.write_header(buf, "::askama_axum::IntoResponse", None)?;
         buf.writeln("#[inline]")?;
-        buf.writeln(
-            "fn into_response(self)\
-             -> ::askama_axum::Response<::askama_axum::BoxBody> {",
-        )?;
+        buf.writeln("fn into_response(self) -> ::askama_axum::Response {")?;
         let ext = self.input.extension().unwrap_or("txt");
         buf.writeln(&format!("::askama_axum::into_response(&self, {:?})", ext))?;
         buf.writeln("}")?;
@@ -1210,7 +1207,7 @@ impl<'a, S: std::hash::BuildHasher> Generator<'a, S> {
                 .config
                 .escapers
                 .iter()
-                .find_map(|(escapers, escaper)| escapers.contains(name).then(|| escaper))
+                .find_map(|(escapers, escaper)| escapers.contains(name).then_some(escaper))
                 .ok_or_else(|| CompileError::from("invalid escaper for escape filter"))?,
             None => self.input.escaper,
         };
diff --git a/askama_shared/src/input.rs b/askama_shared/src/input.rs
index f7eac2336..ad9bb0e56 100644
--- a/askama_shared/src/input.rs
+++ b/askama_shared/src/input.rs
@@ -238,7 +238,7 @@ pub enum Source {
     Source(String),
 }
 
-#[derive(PartialEq)]
+#[derive(Eq, PartialEq)]
 pub enum Print {
     All,
     Ast,
diff --git a/askama_shared/src/lib.rs b/askama_shared/src/lib.rs
index 994662c5f..c6dcda071 100644
--- a/askama_shared/src/lib.rs
+++ b/askama_shared/src/lib.rs
@@ -336,7 +336,6 @@ impl From<String> for CompileError {
 }
 
 #[cfg(test)]
-#[allow(clippy::blacklisted_name)]
 mod tests {
     use super::*;
     use std::env;
diff --git a/askama_shared/src/parser.rs b/askama_shared/src/parser.rs
index 900e71ad7..e821a0a04 100644
--- a/askama_shared/src/parser.rs
+++ b/askama_shared/src/parser.rs
@@ -129,7 +129,7 @@ pub enum Target<'a> {
     Path(Vec<&'a str>),
 }
 
-#[derive(Clone, Copy, Debug, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub struct Ws(pub bool, pub bool);
 
 pub type Cond<'a> = (Ws, Option<CondTest<'a>>, Vec<Node<'a>>);


Test patch:
diff --git a/testing/tests/filters.rs b/testing/tests/filters.rs
index 7973f4570..5229ecd43 100644
--- a/testing/tests/filters.rs
+++ b/testing/tests/filters.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::blacklisted_name)]
-
 #[cfg(feature = "serde-json")]
 #[macro_use]
 extern crate serde_json;
diff --git a/testing/tests/matches.rs b/testing/tests/matches.rs
index 35c120409..f5ccb95e7 100644
--- a/testing/tests/matches.rs
+++ b/testing/tests/matches.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::blacklisted_name)]
-
 use askama::Template;
 
 #[derive(Template)]
diff --git a/testing/tests/operators.rs b/testing/tests/operators.rs
index 05c1dabf4..482c9c6c8 100644
--- a/testing/tests/operators.rs
+++ b/testing/tests/operators.rs
@@ -1,5 +1,3 @@
-#![allow(clippy::blacklisted_name)]
-
 use askama::Template;
 
 #[derive(Template)]
diff --git a/testing/tests/simple.rs b/testing/tests/simple.rs
index dcd324e8b..ebc8267f4 100644
--- a/testing/tests/simple.rs
+++ b/testing/tests/simple.rs
@@ -1,4 +1,4 @@
-#![allow(clippy::blacklisted_name)]
+#![allow(clippy::disallowed_names)] // For the use of `foo` in test cases
 
 use askama::Template;