mdacach / newsletter

Email Newsletter featured in "Zero To Production In Rust"

Email newsletter project based on Zero to Production in Rust.

1. User subscribes to newsletter (user status is set to "pending confirmation")
2. User receives a confirmation email with generated token
3. User confirms email (user status is set to "confirmed")
4. User gets sent an email every time new issue drops

Backend Development

User authorization

• OWASP guidelines
• Password hashing + salt (argon2id hasher with work parameters)
• Protection against preimage attacks, dictionary attacks, timing attacks

Databases

• Postgres with sqlx and support for offline mode (for docker building)
  • Compile-time correctness checks of queries
  • SQL for queries
  • Async support
• Database migrations
• Database transactions

Deployment

• Fly.io Docker app deploy with Postgres cluster
• Zero-downtime deployments (incremental migrations and code updates)

Docker

• Image size optimization (minimal runtimes, multi-stage builds)
• Image build run time optimization (caching dependencies binary with cargo-chef)

Testing

• Unit testing (reqwest)
• Integration testing
• Property-based testing (quickcheck and fake)
• Continuous Integration (GitHub actions)
• Continuous Deployment (fly.io)

Observability

• log logging,
• tracing spans
• bunyan formatting layer

Type-driven development

• Parse, don't validate -> maintaining invariants with newtype pattern

SMTP protocol for sending emails

• lettre

Error handling

• Custom error generation with thiserror and anyhow
• Enum error types for control flow

Actix-web

• Multithreaded execution
• Actix extractors with serde
• Actix middleware
• Actix cookies

Configuration file parsing

• config
• Hierarchical configuration files
• Environment variables parsing

Protection of sensitive data

• secrecy

newsletter's Issues

RUSTSEC-2020-0071: Potential segfault in the time crate

Potential segfault in the time crate

Details
Package	time
Version	0.1.45
URL	time-rs/time#293
Date	2020-11-18
Patched versions	>=0.2.23
Unaffected versions	=0.2.0,=0.2.1,=0.2.2,=0.2.3,=0.2.4,=0.2.5,=0.2.6

Impact

Unix-like operating systems may segfault due to dereferencing a dangling pointer in specific circumstances. This requires an environment variable to be set in a different thread than the affected functions. This may occur without the user's knowledge, notably in a third-party library.

The affected functions from time 0.2.7 through 0.2.22 are:

• time::UtcOffset::local_offset_at
• time::UtcOffset::try_local_offset_at
• time::UtcOffset::current_local_offset
• time::UtcOffset::try_current_local_offset
• time::OffsetDateTime::now_local
• time::OffsetDateTime::try_now_local

The affected functions in time 0.1 (all versions) are:

• at
• at_utc
• now

Non-Unix targets (including Windows and wasm) are unaffected.

Patches

Pending a proper fix, the internal method that determines the local offset has been modified to always return None on the affected operating systems. This has the effect of returning an Err on the try_* methods and UTC on the non-try_* methods.

Users and library authors with time in their dependency tree should perform cargo update, which will pull in the updated, unaffected code.

Users of time 0.1 do not have a patch and should upgrade to an unaffected version: time 0.2.23 or greater or the 0.3 series.

Workarounds

No workarounds are known.

See advisory page for additional details.

RUSTSEC-2021-0141: dotenv is Unmaintained

dotenv is Unmaintained

Details
Status	unmaintained
Package	dotenv
Version	0.15.0
URL	dotenv-rs/dotenv#74
Date	2021-12-24

dotenv by description is meant to be used in development or testing only.

Using this in production may or may not be advisable.

Alternatives

The below may or may not be feasible alternative(s):

• dotenvy

See advisory page for additional details.