arthurdw / firefly

A "blazingly" fast key-value pair database without bloat written in rust

Welcome!

Hello, I'm Arthur, a 21-year-old freelance Computer Science student at VUB. I hold a Bachelor's degree in Applied Computer Science with a specialization in Software Engineering from HOWEST University of Applied Sciences, where I graduated magna cum laude. I enjoy creating solutions for the problems I encounter online.

Currently interested in low level programming with rust.

Current Stack

* ordered from most important first

• Rust [tokio, axum]
• Typescript [Vue (&NuxtJS), Svelte (&kit)]
• Neovim, VSCode or Jetbrains IDE's with VIM bindings
• Unix (See .dotfiles repository for config)
• Ansible
• Terraform
• Prometheus with Grafana
• Docker
• Git
• Figma

Technologies I know

Python, Java, Go, Javascript [including: prisma, vue, react (&NextJs), expressjs], sql, sqlite, cql (with scylladb), mssql, mysql, postgresql, C# (&.NET), php (&Laravel), Windows, Docker, Markdown, CSS (&derivates), Kotlin (&compose), CSS/SCSS/TailwindCSS

Feel free to contact me on discord arthur_dw or mail me [email protected].

Whitepapers

Read my whitepaper about web solutions, a comprehensive analysis of React, Vue, Svelte, Angular, Lit and Hilla here: bachelor-dissertation/main.pdf

firefly's Issues

:zap: Use dashmap instead of a hashmap

Use the xacrimon/dashmap library to allow concurrent operations.
This should greatly improve the speed of the server, and its capabilities.

`std::thread::sleep` in async functions

https://github.com/Arthurdw/firefly/blob/c7d488dba57ef307f0c9402c52325d40584922c9/server/src/database.rs#L207C29-L207C29

This function is blocking, and should not be used in async functions. (docs)

You should use async sleep tokio::time::sleep, otherwise your whole thread is unavailable.

actix-web-4.3.0.crate: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - actix-web-4.3.0.crate

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (actix-web version)	Remediation Available
CVE-2023-26964	High	7.5	h2-0.3.15.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2023-26964

Vulnerable Library - h2-0.3.15.crate

An HTTP/2 client and server

Library home page: https://crates.io/api/v1/crates/h2/0.3.15/download

Dependency Hierarchy:

• actix-web-4.3.0.crate (Root Library)
  • actix-http-3.3.0.crate
    • ❌ h2-0.3.15.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).

Publish Date: 2023-04-11

URL: CVE-2023-26964

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f8vr-r385-rh5r

Release Date: 2023-04-11

Fix Resolution: h2 - 0.3.17

Step up your Open Source Security Game with Mend here

pretty_env_logger-0.4.0.crate: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - pretty_env_logger-0.4.0.crate

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (pretty_env_logger version)	Remediation Available
WS-2023-0223	Critical	9.8	atty-0.2.14.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

WS-2023-0223

Vulnerable Library - atty-0.2.14.crate

A simple interface for querying atty

Library home page: https://crates.io/api/v1/crates/atty/0.2.14/download

Dependency Hierarchy:

• pretty_env_logger-0.4.0.crate (Root Library)
  • env_logger-0.7.1.crate
    • ❌ atty-0.2.14.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

atty potential unaligned read

Publish Date: 2023-06-30

URL: WS-2023-0223

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

Unnecessary manual drop/free

Rust should drop the stream automatically at that point, since it's no longer being referenced after.

firefly/ffly-rs/src/lib.rs

Lines 96 to 101 in 275c66d

	let mut stream = self.tcp_stream.lock().unwrap();
	stream.write(data).await?;
	let mut buffer = vec![0; self.max_buffer_size];
	let response_size = stream.read(&mut buffer).await?;
	drop(stream);

ffly-rs-0.0.6.crate: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - ffly-rs-0.0.6.crate

Path to dependency file: /rest/Cargo.toml

Path to vulnerable library: /server/Cargo.toml,/rest/Cargo.toml

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (ffly-rs version)	Remediation Possible**
CVE-2024-27308	High	7.5	mio-0.8.8.crate	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-27308

Vulnerable Library - mio-0.8.8.crate

Lightweight non-blocking I/O.

Library home page: https://crates.io/api/v1/crates/mio/0.8.8/download

Path to dependency file: /server/Cargo.toml

Path to vulnerable library: /server/Cargo.toml,/rest/Cargo.toml

Dependency Hierarchy:

• ffly-rs-0.0.6.crate (Root Library)
  • tokio-1.32.0.crate
    • ❌ mio-0.8.8.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Mio is a Metal I/O library for Rust. When using named pipes on Windows, mio will under some circumstances return invalid tokens that correspond to named pipes that have already been deregistered from the mio registry. The impact of this vulnerability depends on how mio is used. For some applications, invalid tokens may be ignored or cause a warning or a crash. On the other hand, for applications that store pointers in the tokens, this vulnerability may result in a use-after-free. For users of Tokio, this vulnerability is serious and can result in a use-after-free in Tokio. The vulnerability is Windows-specific, and can only happen if you are using named pipes. Other IO resources are not affected. This vulnerability has been fixed in mio v0.8.11. All versions of mio between v0.7.2 and v0.8.10 are vulnerable. Tokio is vulnerable when you are using a vulnerable version of mio AND you are using at least Tokio v1.30.0. Versions of Tokio prior to v1.30.0 will ignore invalid tokens, so they are not vulnerable. Vulnerable libraries that use mio can work around this issue by detecting and ignoring invalid tokens.

Publish Date: 2024-03-06

URL: CVE-2024-27308

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r8w9-5wcg-vfj7

Release Date: 2024-03-06

Fix Resolution: mio - 0.8.11

Step up your Open Source Security Game with Mend here

tokio-1.21.2.crate: 2 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - tokio-1.21.2.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.2/download

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (tokio version)	Remediation Available
WS-2023-0027	High	9.8	tokio-1.21.2.crate	Direct	tokio - 1.18.5,1.20.4,1.24.2	❌
CVE-2023-22466	Medium	5.4	tokio-1.21.2.crate	Direct	tokio - 1.18.4,1.20.3,1.23.1	❌

Details

WS-2023-0027

Vulnerable Library - tokio-1.21.2.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.2/download

Dependency Hierarchy:

• ❌ tokio-1.21.2.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A soundness issue was discovered in tokio. tokio::io::ReadHalf::unsplit can violate the Pin contract. Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf) is unusual, combined with the difficulty of making any arbitrary use-after-free exploitable in Rust without doing a lot of careful alignment of data types in the surrounding code. The tokio feature io-util is also required to be enabled to trigger this soundness issue.

Publish Date: 2023-02-02

URL: WS-2023-0027

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://rustsec.org/advisories/RUSTSEC-2023-0005.html

Release Date: 2023-02-02

Fix Resolution: tokio - 1.18.5,1.20.4,1.24.2

Step up your Open Source Security Game with Mend here

CVE-2023-22466

Vulnerable Library - tokio-1.21.2.crate

An event-driven, non-blocking I/O platform for writing asynchronous I/O backed applications.

Library home page: https://crates.io/api/v1/crates/tokio/1.21.2/download

Dependency Hierarchy:

• ❌ tokio-1.21.2.crate (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Tokio is a runtime for writing applications with Rust. Starting with version 1.7.0 and prior to versions 1.18.4, 1.20.3, and 1.23.1, when configuring a Windows named pipe server, setting pipe_mode will reset reject_remote_clients to false. If the application has previously configured reject_remote_clients to true, this effectively undoes the configuration. Remote clients may only access the named pipe if the named pipe's associated path is accessible via a publicly shared folder (SMB). Versions 1.23.1, 1.20.3, and 1.18.4 have been patched. The fix will also be present in all releases starting from version 1.24.0. Named pipes were introduced to Tokio in version 1.7.0, so releases older than 1.7.0 are not affected. As a workaround, ensure that pipe_mode is set first after initializing a ServerOptions.

Publish Date: 2023-01-04

URL: CVE-2023-22466

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7rrj-xr53-82p7

Release Date: 2023-01-04

Fix Resolution: tokio - 1.18.4,1.20.3,1.23.1

Step up your Open Source Security Game with Mend here

Docker image arthurdw/firefly is no accessible - autoclosed

Docker image arthurdw/firefly seems to be private on dockerhub

If I visit https://hub.docker.com/repository/docker/arthurdw/firefly I am redirected to the dockerhub login page