Remove xml-rs dependency (#2936)

Author: Porges

src/agent/Cargo.lock

@@ -6,4 +6,4 @@ license = "MIT"
 
 [dependencies]
 anyhow = "1.0"
-quick-xml = "0.27.1"
+quick-xml = "0.28"

src/agent/cobertura/Cargo.toml

@@ -8,7 +8,7 @@ license = "MIT"
 anyhow = "1.0"
 coverage = { path = "../coverage" }
 debuggable-module = { path = "../debuggable-module" }
-quick-xml = "0.27.1"
+quick-xml = "0.28"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = { version = "1.0", features = ["preserve_order"] }
 

src/agent/onefuzz-file-format/Cargo.toml

@@ -35,7 +35,6 @@ reqwest = { version = "0.11", features = [
 ], default-features = false }
 serde = "1.0"
 serde_json = "1.0"
-serde-xml-rs = "0.6"
 onefuzz = { path = "../onefuzz" }
 onefuzz-telemetry = { path = "../onefuzz-telemetry" }
 path-absolutize = "3.0"
@@ -58,13 +57,13 @@ chrono = { version = "0.4", default-features = false, features = [
 ] }
 ipc-channel = { git = "https://github.com/servo/ipc-channel", rev = "7f432aa" }
 
-azure_core = { version = "0.10", default-features = false, features = [
+azure_core = { version = "0.11", default-features = false, features = [
     "enable_reqwest",
 ] }
-azure_storage = { version = "0.10", default-features = false, features = [
+azure_storage = { version = "0.11", default-features = false, features = [
     "enable_reqwest",
 ] }
-azure_storage_blobs = { version = "0.10", default-features = false, features = [
+azure_storage_blobs = { version = "0.11", default-features = false, features = [
     "enable_reqwest",
 ] }
 

src/agent/onefuzz-task/Cargo.toml

@@ -15,7 +15,7 @@ nom = "7"
 pdb = "0.8"
 regex = "1"
 serde = { version = "1", features = ["derive"] }
-quick-xml = "0.27"
+quick-xml = "0.28"
 anyhow = "1.0"
 env_logger = "0.10"
 clap = { version = "4.1.6", features = ["derive"] }

src/agent/srcview/Cargo.toml

@@ -14,14 +14,18 @@ bytes = { version = "1.2", features = ["serde"] }
 derivative = "2.2"
 flume = "0.10"
 num_cpus = "1.15"
+quick-xml = { version = "0.28", features = ["serialize", "serde-types"] }
 regex = "1.7.1"
-reqwest = { version = "0.11", features = ["json", "stream", "native-tls-vendored"], default-features=false }
+reqwest = { version = "0.11", features = [
+    "json",
+    "stream",
+    "native-tls-vendored",
+], default-features = false }
 reqwest-retry = { path = "../reqwest-retry" }
-serde = { version = "1.0", features = ["derive"]}
+serde = { version = "1.0", features = ["derive"] }
 serde_derive = "1.0"
 serde_json = "1.0"
-serde-xml-rs = "0.6"
 bincode = "1.3"
-tokio = { version = "1.24" , features=["full"] }
+tokio = { version = "1.24", features = ["full"] }
 queue-file = "1.4"
 uuid = { version = "0.8", features = ["serde", "v4"] }

src/agent/storage-queue/Cargo.toml

@@ -131,9 +131,11 @@ impl AzureQueueClient {
 
     pub async fn enqueue(&self, data: impl Serialize) -> Result<()> {
         let serialized = serde_json::to_string(&data).unwrap();
-        let body = serde_xml_rs::to_string(&AzureQueueMessageSend {
+        let body = quick_xml::se::to_string(&AzureQueueMessageSend {
             message_text: base64::encode(&serialized),
-        })?;
+        })
+        .context("serializing queue message")?;
+
         self.http
             .post(self.messages_url.clone())
             .body(body)
@@ -165,7 +167,8 @@ impl AzureQueueClient {
             }
         };
 
-        let msg: AzureQueueMessageList = serde_xml_rs::from_reader(buf.reader())?;
+        let msg: AzureQueueMessageList =
+            quick_xml::de::from_reader(buf.reader()).context("deserializing queue message")?;
 
         let m = msg.queue_message.map(|msg| AzureQueueMessage {
             messages_url: Some(self.messages_url.clone()),

src/agent/storage-queue/src/azure_queue.rs

@@ -62,15 +62,15 @@ impl FileQueueClient {
 
     pub async fn enqueue(&self, data: impl Serialize) -> Result<()> {
         let send_data = || async {
-            let mut buffer = Vec::new();
-            serde_xml_rs::to_writer(&mut buffer, &data)
+            let mut buffer = String::new();
+            quick_xml::se::to_writer(&mut buffer, &data)
                 .map_err(|_| anyhow::anyhow!("unable to deserialize"))?;
             let mut locked_q = self
                 .queue
                 .lock()
                 .map_err(|_| anyhow::anyhow!("unable to acquire lock"))?;
             locked_q
-                .add(buffer.as_slice())
+                .add(buffer.as_bytes())
                 .map_err(|_| anyhow::anyhow!("unable to queue message"))?;
             Ok(())
         };

src/agent/storage-queue/src/local_queue.rs

@@ -15,7 +15,6 @@ unmaintained = "deny"
 unsound = "deny"
 yanked = "deny"
 ignore = [
-    "RUSTSEC-2022-0048", # xml-rs is unmaintained
     "RUSTSEC-2023-0018",
     "RUSTSEC-2020-0016", # There is a PR currently open to stop using the unmaintained crate: https://github.com/servo/ipc-channel/pull/302
 ]