RUSTSEC-2023-0001: reject_remote_clients Configuration corruption

[github-actions]

reject_remote_clients Configuration corruption

Details
Package	tokio
Version	1.21.2
URL	GHSA-7rrj-xr53-82p7
Date	2023-01-04
Patched versions	>=1.18.4, <1.19.0,>=1.20.3, <1.21.0,>=1.23.1
Unaffected versions	<1.7.0

On Windows, configuring a named pipe server with pipe_mode will force ServerOptions::reject_remote_clients as false.

This drops any intended explicit configuration for the reject_remote_clients that may have been set as true previously.

The default setting of reject_remote_clients is normally true meaning the default is also overriden as false.

Workarounds

Ensure that pipe_mode is set first after initializing a ServerOptions. For example:

let mut opts = ServerOptions::new();
opts.pipe_mode(PipeMode::Message);
opts.reject_remote_clients(true);

See advisory page for additional details.