mirror of
https://github.com/zed-industries/zed.git
synced 2024-11-10 05:37:29 +03:00
760e1a6db0
This PR contains the following updates:
| Package | Type | Update | Change |
|---|---|---|---|
| [sqlx](https://togithub.com/launchbadge/sqlx) | dev-dependencies |
minor | `0.7` -> `0.8` |
| [sqlx](https://togithub.com/launchbadge/sqlx) | dependencies | minor |
`0.7` -> `0.8` |
### GitHub Vulnerability Alerts
####
[GHSA-xmrp-424f-vfpx](https://togithub.com/launchbadge/sqlx/issues/3440)
The following presentation at this year's DEF CON was brought to our
attention on the SQLx Discord:
> SQL Injection isn't Dead: Smuggling Queries at the Protocol Level
>
<http://web.archive.org/web/20240812130923/https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20presentations/DEF%20CON%2032%20-%20Paul%20Gerste%20-%20SQL%20Injection%20Isn't%20Dead%20Smuggling%20Queries%20at%20the%20Protocol%20Level.pdf>
> (Archive link for posterity.)
Essentially, encoding a value larger than 4GiB can cause the length
prefix in the protocol to overflow,
causing the server to interpret the rest of the string as binary
protocol commands or other data.
It appears SQLx _does_ perform truncating casts in a way that could be
problematic,
for example:
<
|
||
|---|---|---|
| .. | ||
| k8s | ||
| migrations | ||
| migrations_llm | ||
| migrations.sqlite | ||
| src | ||
| .env.toml | ||
| Cargo.toml | ||
| LICENSE-AGPL | ||
| postgrest_app.conf | ||
| postgrest_llm.conf | ||
| README.md | ||
| seed.default.json | ||
Zed Server
This crate is what we run at https://collab.zed.dev.
It contains our back-end logic for collaboration, to which we connect from the Zed client via a websocket after authenticating via https://zed.dev, which is a separate repo running on Vercel.
Local Development
Database setup
Before you can run the collab server locally, you'll need to set up a zed Postgres database.
script/bootstrap
This script will set up the zed Postgres database, and populate it with some users. It requires internet access, because it fetches some users from the GitHub API.
The script will create several admin users, who you'll sign in as by default when developing locally. The GitHub logins for the default users are specified in the seed.default.json file.
To use a different set of admin users, create crates/collab/seed.json.
{
"admins": ["yourgithubhere"],
"channels": ["zed"],
"number_of_users": 20
}
Testing collaborative features locally
In one terminal, run Zed's collaboration server and the livekit dev server:
foreman start
In a second terminal, run two or more instances of Zed.
script/zed-local -2
This script starts one to four instances of Zed, depending on the -2, -3 or -4 flags. Each instance will be connected to the local collab server, signed in as a different user from seed.json or seed.default.json.
Deployment
We run two instances of collab:
- Staging (https://staging-collab.zed.dev)
- Production (https://collab.zed.dev)
Both of these run on the Kubernetes cluster hosted in Digital Ocean.
Deployment is triggered by pushing to the collab-staging (or collab-production) tag in Github. The best way to do this is:
./script/deploy-collab staging./script/deploy-collab production
You can tell what is currently deployed with ./script/what-is-deployed.
Database Migrations
To create a new migration:
./script/create-migration <name>
Migrations are run automatically on service start, so run foreman start again. The service will crash if the migrations fail.
When you create a new migration, you also need to update the SQLite schema that is used for testing.