[BUG][RUST] Vulnerability in indirect dependency of rust-server

Bug Report Checklist

• Have you provided a full/minimal spec to reproduce the issue?
• Have you validated the input using an OpenAPI validator (example)?
• Have you tested with the latest master to confirm the issue still exists?
• Have you searched for related issues/PRs?
• What's the actual output vs expected output?

Description

The rust-server generator has an indirect dependency on the time crate in version 0.1 which is affected by this vulnerability: https://rustsec.org/advisories/RUSTSEC-2020-0071

This is the dependency tree:

time v0.1.45
└── chrono v0.4.26

openapi-generator version

6.6.0, but I have verified that the issue persists with the Cargo.mustache from the current main branch

OpenAPI declaration file content or url

The dependency is hard-coded in Cargo.mustache and thus any specification will reproduce the issue.

Generation Details

Generation is done in a script along the following lines

OPENAPI_GENERATOR_VERSION="6.6.0" \
OPENAPI_GENERATOR_DOWNLOAD_CACHE_DIR="$openapi_cachedir" \
$openapi_cli generate \
    -i "${api_spec}" \
    -o "${out_dir}" \
    -g rust-server \
    --additional-properties=packageName="$package_name"

Steps to reproduce

Generate the code, include the server in a Rust project, then run cargo deny --all-features check which fails due to a security vulnerability in time 0.1.45. The expected result is that there are no security vulnerabilities.

Related issues/PRs

I haven't found any but have reported a similar issue here: https://github.com/Metaswitch/swagger-rs/issues/169

Suggest a fix

A fix for this situation (indirect dependency through chrono is suggested here: https://rustsec.org/advisories/RUSTSEC-2020-0071
Applied to rust-server this would be the fix which I have tested successfully:

diff --git a/modules/openapi-generator/src/main/resources/rust-server/Cargo.mustache b/modules/openapi-generator/src/main/resources/rust-server/Cargo.mustache
index b0df1bc51bf..5d4e393de2f 100644
--- a/modules/openapi-generator/src/main/resources/rust-server/Cargo.mustache
+++ b/modules/openapi-generator/src/main/resources/rust-server/Cargo.mustache
@@ -81,7 +81,7 @@ openssl = {version = "0.10", optional = true }
 [dependencies]
 # Common
 async-trait = "0.1.24"
-chrono = { version = "0.4", features = ["serde"] }
+chrono = { version = "0.4", default-features = false, features = ["serde", "clock"] }
 futures = "0.3"
 swagger = { version = "6.1", features = ["serdejson", "server", "client", "tls", "tcp"] }
 log = "0.4.0"

I can provide a pull request if desirable.

Start with modules/openapi-generator/src/main/resources/rust-server/Cargo.mustache, where the chrono dependency is hard-coded. Review the dependency configuration and run cargo deny --all-features check against generated rust-server code. Done means the generated server no longer pulls vulnerable time 0.1.45 and the security check reports no vulnerabilities.