Repository: EmbarkStudios/cargo-deny (Rust)

Issue:
double-quoted `span` values in JSON output
**Describe the bug**

`cargo deny --format=json check advisory` can emit messages like:

```json
{"fields":{"code":"A007","graphs":[],"labels":[{"column":5,"line":16,"message":"no crate matched advisory criteria","span":"\"RUSTSEC-2020-0071\""}],"message":"advisory was not encountered","severity":"warning"},"type":"diagnostic"}
```

This includes `"span":"\"RUSTSEC-2020-0071\""` -- the advisory id is double-quoted, so if handling this programmatically, you have to strip these extra quotes off of the value.

I'm not 100% sure that this is a bug in itself -- I'm not sure what `span` is supposed to indicate, exactly. The double-quoting seems fishy, though.

If this is working as intended, should an un-quoted `id` field be included somewhere? Other recommendations for handling this data? Just stripping the quotes?

**To Reproduce**

Add a deny.toml block like:
```toml
ignore = [
    "RUSTSEC-2020-0071",
]
```
to a crate that is not impacted by this issue.

```
:; cargo deny --version
cargo-deny 0.11.0
```
crossbeam-utils v0.8.6 is yanked
When installing cargo-deny you get a warning because of yanked crossbeam-utils version.

```
$ cargo install --locked cargo-deny
    Updating crates.io index
  Downloaded cargo-deny v0.11.1
  Downloaded 1 crate (1.1 MB) in 0.49s
  Installing cargo-deny v0.11.1
warning: package `crossbeam-utils v0.8.6` in Cargo.lock is yanked in registry `crates-io`, consider running without --locked
  Downloaded cvss v1.0.2
  […]
```


Discussion:

Patch:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8bdafda..c1334e77 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,8 +8,14 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 <!-- next-header -->
 ## [Unreleased] - ReleaseDate
+### Changed
+- [PR#403](https://github.com/EmbarkStudios/cargo-deny/pull/403) added support for the [`CARGO_TERM_COLOR`](https://doc.rust-lang.org/cargo/reference/config.html#termcolor) environment variable. Thanks [@svenstaro](https://github.com/svenstaro)!
+- [PR#404](https://github.com/EmbarkStudios/cargo-deny/pull/404) updated dependencies.
+
 ### Fixed
 - [PR#398](https://github.com/EmbarkStudios/cargo-deny/pull/398) resolved [#135](https://github.com/EmbarkStudios/cargo-deny/issues/135) by making [`licenses.exceptions`] additive to the global allow list. Thanks [@senden9](https://github.com/senden9)!
+- [PR#404](https://github.com/EmbarkStudios/cargo-deny/pull/404) resolved [#401](https://github.com/EmbarkStudios/cargo-deny/issues/401) by trimming quotes from spans before serializing them as JSON.
+- [PR#404](https://github.com/EmbarkStudios/cargo-deny/pull/404) resolved [#402](https://github.com/EmbarkStudios/cargo-deny/issues/402) by updating crossbeam-utils to a non-yanked version.
 
 ## [0.11.1] - 2022-01-28
 ### Added
diff --git a/Cargo.lock b/Cargo.lock
index e61d1727..bf800455 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -208,7 +208,6 @@ dependencies = [
  "atty",
  "bitvec",
  "cargo",
- "chrono",
  "codespan",
  "codespan-reporting",
  "crossbeam",
@@ -229,6 +228,7 @@ dependencies = [
  "spdx",
  "structopt",
  "tempfile",
+ "time",
  "toml",
  "toml_edit",
  "twox-hash",
@@ -302,9 +302,9 @@ dependencies = [
 
 [[package]]
 name = "cfg-expr"
-version = "0.9.0"
+version = "0.10.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edae0b9625d1fce32f7d64b71784d9b1bf8469ec1a9c417e44aaf16a9cbd7571"
+checksum = "295b6eb918a60a25fec0b23a5e633e74fddbaf7bb04411e65a10c366aca4b5cd"
 dependencies = [
  "smallvec",
  "target-lexicon",
@@ -316,19 +316,6 @@ version = "1.0.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "baf1de4339761588bc0619e3cbc0120ee582ebb74b53b4efbf79117bd2da40fd"
 
-[[package]]
-name = "chrono"
-version = "0.4.19"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "670ad68c9088c2a963aaa298cb369688cf3f9465ce5e2d4ca10e6e0098a1ce73"
-dependencies = [
- "libc",
- "num-integer",
- "num-traits",
- "time",
- "winapi",
-]
-
 [[package]]
 name = "clap"
 version = "2.34.0"
@@ -485,9 +472,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-epoch"
-version = "0.9.6"
+version = "0.9.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97242a70df9b89a65d0b6df3c4bf5b9ce03c5b7309019777fbde37e7537f8762"
+checksum = "c00d6d2ea26e8b151d99093005cb442fb9a37aeaca582a03ec70946f49ab5ed9"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -498,9 +485,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-queue"
-version = "0.3.3"
+version = "0.3.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b979d76c9fcb84dffc80a73f7290da0f83e4c95773494674cb44b76d13a7a110"
+checksum = "4dd435b205a4842da59efd07628f921c096bc1cc0a156835b4fa0bcb9a19bcce"
 dependencies = [
  "cfg-if",
  "crossbeam-utils",
@@ -508,9 +495,9 @@ dependencies = [
 
 [[package]]
 name = "crossbeam-utils"
-version = "0.8.6"
+version = "0.8.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "cfcae03edb34f947e64acdb1c33ec169824e20657e9ecb61cef6c8c74dcb8120"
+checksum = "b5e5bed1f1c269533fa816a0a5492b3545209a205ca1a54842be180eb63a16a6"
 dependencies = [
  "cfg-if",
  "lazy_static",
@@ -887,9 +874,9 @@ dependencies = [
 
 [[package]]
 name = "krates"
-version = "0.9.0"
+version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8549dc44b3c544e5326df8e032191977519cbec37a2de2650d14024bcf2ee70a"
+checksum = "44e5f5e84e0e156e16781f28d5af802adbc78a45cfba8cce54f1e21d273c2af9"
 dependencies = [
  "cargo_metadata",
  "cfg-expr",
@@ -920,9 +907,9 @@ checksum = "830d08ce1d1d941e6b30645f1a0eb5643013d835ce3779a5fc208261dbe10f55"
 
 [[package]]
 name = "libc"
-version = "0.2.115"
+version = "0.2.117"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0a8d982fa7a96a000f6ec4cfe966de9703eccde29750df2bb8949da91b0e818d"
+checksum = "e74d72e0f9b65b5b4ca49a346af3976df0f9c61d550727f349ecd559f251a26c"
 
 [[package]]
 name = "libgit2-sys"
@@ -1023,16 +1010,6 @@ dependencies = [
  "winapi",
 ]
 
-[[package]]
-name = "num-integer"
-version = "0.1.44"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d2cc698a63b549a70bc047073d2949cce27cd1c7b0a4a862d08a8031bc2801db"
-dependencies = [
- "autocfg",
- "num-traits",
-]
-
 [[package]]
 name = "num-traits"
 version = "0.2.14"
@@ -1052,6 +1029,15 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "num_threads"
+version = "0.1.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "97ba99ba6393e2c3734791401b66902d981cb03bf190af674ca69949b6d5fb15"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "once_cell"
 version = "1.9.0"
@@ -1113,9 +1099,9 @@ dependencies = [
 
 [[package]]
 name = "os_info"
-version = "3.1.0"
+version = "3.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "198e392be7e882f0c2836f425e430f81d9a0e99651e4646311347417cddbfd43"
+checksum = "023df84d545ef479cf67fd2f4459a613585c9db4852c2fad12ab70587859d340"
 dependencies = [
  "log",
  "serde",
@@ -1376,9 +1362,9 @@ checksum = "d29ab0c6d3fc0ee92fe66e2d99f700eab17a8d57d1c1d3b748380fb20baa78cd"
 
 [[package]]
 name = "semver"
-version = "1.0.4"
+version = "1.0.5"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "568a8e6258aa33c13358f81fd834adb854c6f7c9468520910a9b1e8fac068012"
+checksum = "0486718e92ec9a68fbed73bb5ef687d71103b142595b406835649bebd33f72c7"
 dependencies = [
  "serde",
 ]
@@ -1473,9 +1459,9 @@ dependencies = [
 
 [[package]]
 name = "spdx"
-version = "0.8.0"
+version = "0.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a31283ed7fe3bca10f3e5ec2fe2787f16764a4275949606fd48d4fc919a760e3"
+checksum = "78bce5b26be49ead8eac0bbdec432b2c52ccfbfeff1ab814fc78bf53e003422e"
 dependencies = [
  "smallvec",
 ]
@@ -1554,9 +1540,9 @@ dependencies = [
 
 [[package]]
 name = "target-lexicon"
-version = "0.12.2"
+version = "0.12.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d9bffcddbc2458fa3e6058414599e3c838a022abae82e5c67b4f7f80298d5bff"
+checksum = "d7fa7e55043acb85fca6b3c01485a2eeb6b69c5d21002e273c79e465f43b7ac1"
 
 [[package]]
 name = "tempfile"
@@ -1621,15 +1607,22 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.1.44"
+version = "0.3.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
+checksum = "004cbc98f30fa233c61a38bc77e96a9106e65c88f2d3bef182ae952027e5753d"
 dependencies = [
+ "itoa",
  "libc",
- "wasi",
- "winapi",
+ "num_threads",
+ "time-macros",
 ]
 
+[[package]]
+name = "time-macros"
+version = "0.2.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "25eb0ca3468fc0acc11828786797f6ef9aa1555e4a211a60d64cc8e4d1be47d6"
+
 [[package]]
 name = "tinyvec"
 version = "1.5.1"
@@ -1656,9 +1649,9 @@ dependencies = [
 
 [[package]]
 name = "toml_edit"
-version = "0.6.0"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b46c9238346fec3169f99251eda26e918ab71cdf382a660e46076ff1b1b16729"
+checksum = "744e9ed5b352340aa47ce033716991b5589e23781acb97cad37d4ea70560f55b"
 dependencies = [
  "combine",
  "indexmap",
@@ -1699,9 +1692,9 @@ dependencies = [
 
 [[package]]
 name = "unicode-segmentation"
-version = "1.8.0"
+version = "1.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8895849a949e7845e06bd6dc1aa51731a103c42707010a5b591c0038fb73385b"
+checksum = "7e8820f5d777f6224dc4be3632222971ac30164d4a258d595640799554ebfd99"
 
 [[package]]
 name = "unicode-width"
@@ -1784,12 +1777,6 @@ dependencies = [
  "winapi-util",
 ]
 
-[[package]]
-name = "wasi"
-version = "0.10.0+wasi-snapshot-preview1"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
-
 [[package]]
 name = "winapi"
 version = "0.3.9"
diff --git a/Cargo.toml b/Cargo.toml
index ddd4d638..d458f550 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -46,8 +46,6 @@ atty = "0.2"
 bitvec = { version = "1.0", features = ["alloc"] }
 # Allows us to do eg cargo metadata operations without relying on an external cargo
 cargo = { version = "0.59", optional = true }
-# Timey wimey stuff
-chrono = "0.4"
 # Used for diagnostic reporting
 codespan = "0.11"
 codespan-reporting = "0.11"
@@ -63,7 +61,7 @@ git2 = "0.13"
 # We need to figure out HOME/CARGO_HOME in some cases
 home = "0.5"
 # Provides graphs on top of cargo_metadata
-krates = { version = "0.9", features = ["targets"] }
+krates = { version = "0.10", features = ["targets"] }
 # Log macros
 log = "0.4"
 # Used when parsing binary files in registry index caches
@@ -83,10 +81,15 @@ smallvec = "1.6"
 spdx = "0.8"
 # Handles all of the argument parsing
 structopt = "0.3"
+# Timestamp emission
+time = { version = "0.3", default-features = false, features = [
+  "formatting",
+  "macros",
+] }
 # Deserialization of configuration files and crate manifests
 toml = "0.5"
 # Used by fix to modify crate manifests
-toml_edit = "0.6"
+toml_edit = "0.13"
 # Small fast hash crate
 twox-hash = { version = "1.5", default-features = false }
 # Url parsing/manipulation
diff --git a/deny.toml b/deny.toml
index 7b0157a3..fdfa888e 100644
--- a/deny.toml
+++ b/deny.toml
@@ -13,11 +13,7 @@ vulnerability = "deny"
 unmaintained = "deny"
 notice = "deny"
 unsound = "deny"
-ignore = [
-    # time/chrono problems, have not been a problem in practice
-    "RUSTSEC-2020-0159",
-    "RUSTSEC-2020-0071",
-]
+ignore = []
 
 [bans]
 multiple-versions = "deny"
diff --git a/src/cargo-deny/main.rs b/src/cargo-deny/main.rs
index e78de159..e09d8f86 100644
--- a/src/cargo-deny/main.rs
+++ b/src/cargo-deny/main.rs
@@ -258,15 +258,20 @@ fn setup_logger(
     use ansi_term::Color::{Blue, Green, Purple, Red, Yellow};
     use log::Level::{Debug, Error, Info, Trace, Warn};
 
+    let now = time::OffsetDateTime::now_utc();
+
     match format {
         Format::Human => {
+            const HUMAN: &[time::format_description::FormatItem<'static>] =
+                time::macros::format_description!("[year]-[month]-[day] [hour]:[minute]:[second]");
+
             if color {
                 fern::Dispatch::new()
                     .level(level)
                     .format(move |out, message, record| {
                         out.finish(format_args!(
                             "{date} [{level}] {message}\x1B[0m",
-                            date = chrono::Utc::now().format("%Y-%m-%d %H:%M:%S"),
+                            date = now.format(&HUMAN).unwrap(),
                             level = match record.level() {
                                 Error => Red.paint("ERROR"),
                                 Warn => Yellow.paint("WARN"),
@@ -285,7 +290,7 @@ fn setup_logger(
                     .format(move |out, message, record| {
                         out.finish(format_args!(
                             "{date} [{level}] {message}",
-                            date = chrono::Utc::now().format("%Y-%m-%d %H:%M:%S"),
+                            date = now.format(&HUMAN).unwrap(),
                             level = match record.level() {
                                 Error => "ERROR",
                                 Warn => "WARN",
@@ -309,7 +314,7 @@ fn setup_logger(
                         serde_json::json! {{
                             "type": "log",
                             "fields": {
-                                "timestamp": chrono::Utc::now().to_rfc3339(),
+                                "timestamp": now.format(&time::format_description::well_known::Rfc3339).unwrap(),
                                 "level": match record.level() {
                                     Error => "ERROR",
                                     Warn => "WARN",
diff --git a/src/diag/obj_grapher.rs b/src/diag/obj_grapher.rs
index 52c99f65..0000b034 100644
--- a/src/diag/obj_grapher.rs
+++ b/src/diag/obj_grapher.rs
@@ -147,7 +147,7 @@ pub fn cs_diag_to_json(diag: CsDiag, files: &Files) -> serde_json::Value {
                     .unwrap();
                 labels.push(serde_json::json!({
                     "message": label.message,
-                    "span": &files.source(label.file_id)[label.range],
+                    "span": files.source(label.file_id)[label.range].trim_matches('"'),
                     "line": location.line.to_usize() + 1,
                     "column": location.column.to_usize() + 1,
                 }));
diff --git a/src/manifest.rs b/src/manifest.rs
index 6bf03794..5f5976ff 100644
--- a/src/manifest.rs
+++ b/src/manifest.rs
@@ -116,7 +116,7 @@ impl Manifest {
             }
         }
 
-        descend(&mut self.doc.root, table_path)
+        descend(self.doc.as_item_mut(), table_path)
     }
 
     pub fn update_table_named_entry(


Test patch:
diff --git a/tests/bans.rs b/tests/bans.rs
index 03f8124a..51f515d2 100644
--- a/tests/bans.rs
+++ b/tests/bans.rs
@@ -48,9 +48,9 @@ wrappers = ["safe-wrapper"]
         "banned crate 'dangerous-dep = 0.1.0' allowed by wrapper 'safe-wrapper = 0.1.0'"
     );
     assert_field_eq!(diag, "/fields/labels/0/message", "banned here");
-    assert_field_eq!(diag, "/fields/labels/0/span", "\"dangerous-dep\"");
+    assert_field_eq!(diag, "/fields/labels/0/span", "dangerous-dep");
     assert_field_eq!(diag, "/fields/labels/1/message", "allowed wrapper");
-    assert_field_eq!(diag, "/fields/labels/1/span", "\"safe-wrapper\"");
+    assert_field_eq!(diag, "/fields/labels/1/span", "safe-wrapper");
 }
 
 #[test]
@@ -82,7 +82,7 @@ name = "dangerous-dep"
         "crate 'dangerous-dep = 0.1.0' is explicitly banned"
     );
     assert_field_eq!(diag, "/fields/labels/0/message", "banned here");
-    assert_field_eq!(diag, "/fields/labels/0/span", "\"dangerous-dep\"");
+    assert_field_eq!(diag, "/fields/labels/0/span", "dangerous-dep");
 }
 
 #[test]