[codebase] [cli] quick-xml 0.37.5 + 0.38.4 vulnerable to RUSTSEC-2026-0194/0195

[BillyOutlast]

Problem

cli/Cargo.toml has two transitive quick-xml versions in its lockfile: 0.37.5 (via reqsign 0.16.5) and 0.38.4 (via opendal 0.55.0). Both are affected by two CVSS 7.5 HIGH advisories published 2026-07-02:

• RUSTSEC-2026-0194 — Quadratic runtime in Attributes iterator duplicate-attribute check → CPU DoS on untrusted XML
• RUSTSEC-2026-0195 — Unbounded namespace-declaration allocation in NsReader → memory exhaustion DoS

Both are fixed in quick-xml >= 0.41.0 (released 2026-06-29).

Reverse Dependency Chain

downpour v0.1.0
└── opendal v0.55.0
    ├── quick-xml v0.38.4   ← vulnerable (direct)
    └── reqsign v0.16.5
        └── quick-xml v0.37.5   ← vulnerable (transitive)

Why This Was Hidden

Prior to PR #163, the CLI CI workflow ran the new-vuln step but the continue-on-error: true flag on cargo audit (rust-ci/action.yml:129) swallowed the exit-1. The adversarial CI audit in #157/#163 un-rubber-stamped this by adding a follow-up step that fails ONLY on NEW (un-ignored) advisories — which immediately surfaced both quick-xml CVEs.

Impact

• The cli binary is intended for admin tasks (uploading game content). opendal is the S3 storage backend dep.
• The DoS vectors only fire on untrusted XML input to quick-xml parsers. The Drop server-side does NOT parse untrusted XML using these crates directly. The risk surface depends on what XML the CLI reads from S3 responses or local files.
• Real risk is low-to-moderate today but the CVEs are public and the upstream crates won't bump without coordinated action.

Upstream Status (as of 2026-07-27)

• quick-xml 0.41.0: FIX released 2026-06-29, available on crates.io.
• opendal 0.57.0 (released 2026-06-01): does NOT yet bump quick-xml. No opendal version on crates.io has the fix. PR #7479 was the last quick-xml bump in opendal (0.37→0.38, July 2025).
• reqsign 0.16.5: same — no published fix version.

Goal

Out of scope for the CI hardening workstream (#163). This issue exists to track the actual fix: either bump opendal/reqsign when they release quick-xml 0.41, or apply a [patch.crates-io] workaround.

Suggested Approach (in priority order)

1. Wait for upstream fix. Track opendal PR/issue for quick-xml 0.41 bump. Update cli when a fixed opendal version ships. ETA unknown — could be weeks.

2. Patch override now (interim). Add to cli/Cargo.toml:

   [patch.crates-io]
   quick-xml = { git = "https://github.com/tafia/quick-xml.git", tag = "v0.41.0" }

   This forces both transitive versions to coalesce on 0.41.0. The 0.41 release is purely bug-fix + additive API (resolver_mut()); no API breakage. Risk: cargo's [patch.crates-io] with git source requires network access at build time and may break offline builds.

3. Document in security/risk-register.yaml if the team accepts the risk temporarily. Then the new-vuln step needs the same ignore logic as GHSA-mp2f-45pm-3cg9.

Acceptance Criteria

• cargo tree -i quick-xml shows zero versions < 0.41.0
• cargo audit (run via the new-vuln step) reports zero new advisories
• pnpm --filter drop exec vitest run (or cargo test) still passes
• Build works offline (if patch approach chosen)

Verification

After fix:

cd cli && cargo tree -i quick-xml
# Expected: empty, or only quick-xml@0.41.0+
cargo audit
# Expected: zero findings

Provenance

Surfaced by adversarial CI audit (umbrella #157, PR #163). The new-vuln detection step in rust-ci/action.yml correctly identified both CVEs.