From: Kirill A. Korinsky <kirill@korins.ky>
Subject: Re: UPDATE security/vaultwarden-1.32.7
To: Theo Buehler <tb@theobuehler.org>
Cc: bket@openbsd.org, ports@openbsd.org
Date: Sat, 28 Dec 2024 14:59:54 +0100

On Sat, 28 Dec 2024 12:49:11 +0100,
Theo Buehler <tb@theobuehler.org> wrote:
> 
> On Sat, Dec 28, 2024 at 12:22:34PM +0100, Theo Buehler wrote:
> > > Index: security/vaultwarden/patches/patch-src_api_icons_rs
> > > ===================================================================
> > > RCS file: security/vaultwarden/patches/patch-src_api_icons_rs
> > > diff -N security/vaultwarden/patches/patch-src_api_icons_rs
> > > --- /dev/null	1 Jan 1970 00:00:00 -0000
> > > +++ security/vaultwarden/patches/patch-src_api_icons_rs	28 Dec 2024 11:14:11 -0000
> > > @@ -0,0 +1,13 @@
> > > +Index: src/api/icons.rs
> > > +--- src/api/icons.rs.orig
> > > ++++ src/api/icons.rs
> > > +@@ -270,7 +270,8 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, 
> > > + 
> > > +     let mut base_url = url.clone();
> > > +     let mut icon_tags: Vec<Tag> = Vec::new();
> > > +-    for Ok(token) in dom {
> > > ++    for maybe_token in dom {
> > > ++        let token = maybe_token.unwrap();
> > 
> > 	while let Ok(token) in dom {
> 
> Sorry, not enough coffee. Ignore me.
> 

No, I think you're correct and it may lead to a panic.

Here just this patch which behaves as it should.

Ok?

Index: src/api/icons.rs
--- src/api/icons.rs.orig
+++ src/api/icons.rs
@@ -270,7 +270,7 @@ fn get_favicons_node(dom: Tokenizer<StringReader<'_>, 
 
     let mut base_url = url.clone();
     let mut icon_tags: Vec<Tag> = Vec::new();
-    for Ok(token) in dom {
+    for token in dom.into_iter().filter_map(Result::ok) {
         let tag_name: &[u8] = &token.tag.name;
         match tag_name {
             TAG_LINK => {




-- 
wbr, Kirill