Fix vulnerability in desktop client 1.5.2 (GHSA-wrw7-89jp-8q8g)

[kchudy]

Vulnerability GHSA-wrw7-89jp-8q8g

If the vulnerability can't be fixed at the moment, update the SBOM status page.

[wojcik91]

I updated our trivy config - now the ignored vulnerabilities will be included in the report along with our comment.

Example JSON output:

{
  "SchemaVersion": 2,
  "CreatedAt": "2025-11-10T14:43:38.756722088+01:00",
  "ArtifactName": ".",
  "ArtifactType": "filesystem",
  "Metadata": {
    "RepoURL": "git@github.com:DefGuard/client.git",
    "Branch": "migrate_trivyignore_format",
    "Commit": "e20e81b11e28b08bdd97dd62b9b20d3ad98e3a35",
    "CommitMsg": "fix typo",
    "Author": "Maciej Wójcik \u003cmaciej@defguard.net\u003e",
    "Committer": "Maciej Wójcik \u003cmaciej@defguard.net\u003e"
  },
  "Results": [
    {
      "Target": "pnpm-lock.yaml",
      "Class": "lang-pkgs",
      "Type": "pnpm"
    },
    {
      "Target": "src-tauri/Cargo.lock",
      "Class": "lang-pkgs",
      "Type": "cargo",
      "ExperimentalModifiedFindings": [
        {
          "Type": "vulnerability",
          "Status": "ignored",
          "Statement": "glib is a transitive dependency of Tauri which we cannot update ourselves. Waiting for tauri to finish migration to gtk4-rs: https://github.com/tauri-apps/tauri/issues/12563",
          "Source": ".trivyignore.yaml",
          "Finding": {
            "VulnerabilityID": "GHSA-wrw7-89jp-8q8g",
            "PkgID": "glib@0.18.5",
            "PkgName": "glib",
            "PkgIdentifier": {
              "PURL": "pkg:cargo/glib@0.18.5",
              "UID": "2d0e53412672303a"
            },
            "InstalledVersion": "0.18.5",
            "FixedVersion": "0.20.0",
            "Status": "fixed",
            "SeveritySource": "ghsa",
            "PrimaryURL": "https://github.com/advisories/GHSA-wrw7-89jp-8q8g",
            "DataSource": {
              "ID": "ghsa",
              "Name": "GitHub Security Advisory Rust",
              "URL": "https://github.com/advisories?query=type%3Areviewed+ecosystem%3Arust"
            },
            "Title": "Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`",
            "Description": "The `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour.\n\nAn immutable reference `\u0026p` to a `*mut libc::c_char` pointer initialized to `NULL` was passed as an argument to a C function that that mutates the pointer behind `\u0026p` in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through `\u0026p` now seem to be completely disregarded when building the `glib` crate with optimizations.\n\nThis subsequently caused all calls of `VariantStrIter::impl_get` to violate the safety requirements of the `std::ffi::CStr::from_ptr` function - which requires its argument to be a valid pointer to a C-style string - resulting in crashes due to `NULL` pointer dereferences.\n\nThis was fixed by passing the out-argument pointer explitly as `\u0026mut p` instead of `\u0026p`.\n\nThis issue has been present since this code was initially added in `glib` v0.15.0. The mismatch in mutability was likely missed (and not raised as an error by the compiler) because the C function wrapped by `VariantStrIter::impl_get` is variadic (`glib_sys::g_variant_get_child`), and the pointer in question is one of the variadic arguments.\n\n",
            "Severity": "MEDIUM",
            "VendorSeverity": {
              "ghsa": 2
            },
            "References": [
              "https://github.com/gtk-rs/gtk-rs-core",
              "https://github.com/gtk-rs/gtk-rs-core/pull/1343",
              "https://rustsec.org/advisories/RUSTSEC-2024-0429.html"
            ],
            "PublishedDate": "2024-12-23T20:19:24Z",
            "LastModifiedDate": "2024-12-23T20:19:24Z"
          }
        }
      ]
    },
    {
      "Target": "swift/boringtun/Cargo.lock",
      "Class": "lang-pkgs",
      "Type": "cargo"
    }
  ]
}

This will not break our SBOM page since the ignored vulnerabiities are in a separate field (ExperimentalModifiedFindings).

Our SBOM page still has to be updated to properly handle ignored vulnerabilities and display our comments.

[wojcik91]

• update landing page to display ignored vulnerabilities & our comments
• [ ] update other component repos to use the same trivy format (we don't have ignore files in other repositories yet)