scm-commits April 2023

scm-commits@lists.fedoraproject.org

1 participants
20867 discussions

mtasaka pushed to rpms/rubygem-redcarpet (f36). "Bacckport upstream patch for CVE-2020-26298 (bug 1915370)"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 11:02:30 UTC From 0bc4066bad9d08a4742ec537dc2df262990308ff Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA <mtasaka(a)fedoraproject.org> Date: Apr 30 2023 10:59:16 +0000 Subject: Bacckport upstream patch for CVE-2020-26298 (bug 1915370) --- diff --git a/redcarpet-3.3.2-CVE-2020-26298.patch b/redcarpet-3.3.2-CVE-2020-26298.patch new file mode 100644 index 0000000..a497676 --- /dev/null +++ b/redcarpet-3.3.2-CVE-2020-26298.patch @@ -0,0 +1,56 @@ +From a699c82292b17c8e6a62e1914d5eccc252272793 Mon Sep 17 00:00:00 2001 +From: Robin Dupret <robin.dupret(a)hey.com> +Date: Tue, 15 Dec 2020 20:57:32 +0100 +Subject: [PATCH] Fix a security issue using `:quote` with `:escape_html` + +Reported by @johan-smits. +--- + CHANGELOG.md | 7 +++++++ + ext/redcarpet/html.c | 9 ++++++++- + lib/redcarpet.rb | 2 +- + redcarpet.gemspec | 4 ++-- + test/markdown_test.rb | 10 ++++++++++ + 5 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/ext/redcarpet/html.c b/ext/redcarpet/html.c +index 805ddd8e..785f780f 100644 +--- a/ext/redcarpet/html.c ++++ b/ext/redcarpet/html.c +@@ -255,8 +255,15 @@ rndr_quote(struct buf *ob, const struct buf *text, void *opaque) + if (!text || !text->size) + return 0; + ++ struct html_renderopt *options = opaque; ++ + BUFPUTSL(ob, "<q>"); +- bufput(ob, text->data, text->size); ++ ++ if (options->flags & HTML_ESCAPE) ++ escape_html(ob, text->data, text->size); ++ else ++ bufput(ob, text->data, text->size); ++ + BUFPUTSL(ob, "</q>"); + + return 1; +diff --git a/test/markdown_test.rb b/test/markdown_test.rb +index 4347be9b..68de1255 100644 +--- a/test/markdown_test.rb ++++ b/test/markdown_test.rb +@@ -220,6 +220,16 @@ def test_quote_flag_works + assert output.include? '<q>quote</q>' + end + ++ def test_quote_flag_honors_escape_html ++ text = 'We are not "<svg/onload=pwned>"' ++ ++ output_enabled = render(text, with: [:quote, :escape_html]) ++ output_disabled = render(text, with: [:quote]) ++ ++ assert_equal "<p>We are not <q><svg/onload=pwned></q></p>\n", output_enabled ++ assert_equal "<p>We are not <q><svg/onload=pwned></q></p>\n", output_disabled ++ end ++ + def test_that_fenced_flag_works + text = <<fenced + This is a simple test diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 8b4ab30..fcfa04c 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,13 +2,21 @@ Name: rubygem-%{gem_name} Version: 3.3.2 -Release: 25%{?dist} +Release: 26%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 License: MIT and ISC URL: http://github.com/vmg/redcarpet Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem +# https://github.com/advisories/GHSA-q3wr-qw3g-3p4h +# https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc2522… +# https://nvd.nist.gov/vuln/detail/CVE-2020-26298 +# Fix a security issue using :quote with :escape_html +# Fixed in 3.5.1 +# A bit modified for 3.3.2 +# Note that 14942b4f5ef8dbaeeff8d9212f098391d7c1fbdc does chomp, reverting this +Patch0: %{gem_name}-3.3.2-CVE-2020-26298.patch BuildRequires: gcc BuildRequires: ruby(release) @@ -29,6 +37,7 @@ Documentation for %{name}. %prep %setup -q -n %{gem_name}-%{version} +%patch -P0 -p1 %build gem build ../%{gem_name}-%{version}.gemspec @@ -87,6 +96,9 @@ popd %changelog +* Sun Apr 30 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.3.2-26 +- Bacckport upstream patch for CVE-2020-26298 (bug 1915370) + * Fri Jan 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/0bc4066bad9d08a4742e…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (f36). "Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild (..more)"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 11:02:29 UTC From 152534a9d8de69e74983f24e1058aa6b081da572 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering <releng(a)fedoraproject.org> Date: Jan 20 2023 21:01:52 +0000 Subject: Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org> --- diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 1b7c782..a290c2a 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.3.2 -Release: 24%{?dist} +Release: 25%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 License: MIT and ISC @@ -75,6 +75,9 @@ popd %changelog +* Fri Jan 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.3.2-25 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Wed Jan 04 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.3.2-24 - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2 https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/152534a9d8de69e74983…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (f37). "Bacckport upstream patch for CVE-2020-26298 (bug 1915370)"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 11:02:15 UTC From 0bc4066bad9d08a4742ec537dc2df262990308ff Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA <mtasaka(a)fedoraproject.org> Date: Apr 30 2023 10:59:16 +0000 Subject: Bacckport upstream patch for CVE-2020-26298 (bug 1915370) --- diff --git a/redcarpet-3.3.2-CVE-2020-26298.patch b/redcarpet-3.3.2-CVE-2020-26298.patch new file mode 100644 index 0000000..a497676 --- /dev/null +++ b/redcarpet-3.3.2-CVE-2020-26298.patch @@ -0,0 +1,56 @@ +From a699c82292b17c8e6a62e1914d5eccc252272793 Mon Sep 17 00:00:00 2001 +From: Robin Dupret <robin.dupret(a)hey.com> +Date: Tue, 15 Dec 2020 20:57:32 +0100 +Subject: [PATCH] Fix a security issue using `:quote` with `:escape_html` + +Reported by @johan-smits. +--- + CHANGELOG.md | 7 +++++++ + ext/redcarpet/html.c | 9 ++++++++- + lib/redcarpet.rb | 2 +- + redcarpet.gemspec | 4 ++-- + test/markdown_test.rb | 10 ++++++++++ + 5 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/ext/redcarpet/html.c b/ext/redcarpet/html.c +index 805ddd8e..785f780f 100644 +--- a/ext/redcarpet/html.c ++++ b/ext/redcarpet/html.c +@@ -255,8 +255,15 @@ rndr_quote(struct buf *ob, const struct buf *text, void *opaque) + if (!text || !text->size) + return 0; + ++ struct html_renderopt *options = opaque; ++ + BUFPUTSL(ob, "<q>"); +- bufput(ob, text->data, text->size); ++ ++ if (options->flags & HTML_ESCAPE) ++ escape_html(ob, text->data, text->size); ++ else ++ bufput(ob, text->data, text->size); ++ + BUFPUTSL(ob, "</q>"); + + return 1; +diff --git a/test/markdown_test.rb b/test/markdown_test.rb +index 4347be9b..68de1255 100644 +--- a/test/markdown_test.rb ++++ b/test/markdown_test.rb +@@ -220,6 +220,16 @@ def test_quote_flag_works + assert output.include? '<q>quote</q>' + end + ++ def test_quote_flag_honors_escape_html ++ text = 'We are not "<svg/onload=pwned>"' ++ ++ output_enabled = render(text, with: [:quote, :escape_html]) ++ output_disabled = render(text, with: [:quote]) ++ ++ assert_equal "<p>We are not <q><svg/onload=pwned></q></p>\n", output_enabled ++ assert_equal "<p>We are not <q><svg/onload=pwned></q></p>\n", output_disabled ++ end ++ + def test_that_fenced_flag_works + text = <<fenced + This is a simple test diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 8b4ab30..fcfa04c 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,13 +2,21 @@ Name: rubygem-%{gem_name} Version: 3.3.2 -Release: 25%{?dist} +Release: 26%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 License: MIT and ISC URL: http://github.com/vmg/redcarpet Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem +# https://github.com/advisories/GHSA-q3wr-qw3g-3p4h +# https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc2522… +# https://nvd.nist.gov/vuln/detail/CVE-2020-26298 +# Fix a security issue using :quote with :escape_html +# Fixed in 3.5.1 +# A bit modified for 3.3.2 +# Note that 14942b4f5ef8dbaeeff8d9212f098391d7c1fbdc does chomp, reverting this +Patch0: %{gem_name}-3.3.2-CVE-2020-26298.patch BuildRequires: gcc BuildRequires: ruby(release) @@ -29,6 +37,7 @@ Documentation for %{name}. %prep %setup -q -n %{gem_name}-%{version} +%patch -P0 -p1 %build gem build ../%{gem_name}-%{version}.gemspec @@ -87,6 +96,9 @@ popd %changelog +* Sun Apr 30 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.3.2-26 +- Bacckport upstream patch for CVE-2020-26298 (bug 1915370) + * Fri Jan 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/0bc4066bad9d08a4742e…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (f37). "Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild (..more)"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 11:02:15 UTC From 152534a9d8de69e74983f24e1058aa6b081da572 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering <releng(a)fedoraproject.org> Date: Jan 20 2023 21:01:52 +0000 Subject: Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org> --- diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 1b7c782..a290c2a 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.3.2 -Release: 24%{?dist} +Release: 25%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 License: MIT and ISC @@ -75,6 +75,9 @@ popd %changelog +* Fri Jan 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.3.2-25 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Wed Jan 04 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.3.2-24 - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2 https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/152534a9d8de69e74983…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (f37). "Indentation, some unneeded files cleanup"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 11:02:15 UTC From 8d17959621b7be03176998611d6ef46636e83774 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA <mtasaka(a)fedoraproject.org> Date: Apr 30 2023 05:05:03 +0000 Subject: Indentation, some unneeded files cleanup --- diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index a290c2a..8b4ab30 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -1,29 +1,30 @@ %global gem_name redcarpet -Name: rubygem-%{gem_name} -Version: 3.3.2 -Release: 25%{?dist} -Summary: A fast, safe and extensible Markdown to (X)HTML parser +Name: rubygem-%{gem_name} +Version: 3.3.2 +Release: 25%{?dist} + +Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 -License: MIT and ISC -URL: http://github.com/vmg/redcarpet -Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem -BuildRequires: gcc -BuildRequires: ruby(release) -BuildRequires: rubygems-devel -BuildRequires: ruby-devel -BuildRequires: rubygem(test-unit) +License: MIT and ISC +URL: http://github.com/vmg/redcarpet +Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem + +BuildRequires: gcc +BuildRequires: ruby(release) +BuildRequires: rubygems-devel +BuildRequires: ruby-devel +BuildRequires: rubygem(test-unit) %description A fast, safe and extensible Markdown to (X)HTML parser. +%package doc +Summary: Documentation for %{name} +Requires: %{name} = %{version}-%{release} +BuildArch: noarch -%package doc -Summary: Documentation for %{name} -Requires: %{name} = %{version}-%{release} -BuildArch: noarch - -%description doc +%description doc Documentation for %{name}. %prep @@ -45,32 +46,43 @@ cp -a ./%{_bindir}/* %{buildroot}%{_bindir} chmod 755 %{buildroot}%{_bindir}/redcarpet mkdir -p %{buildroot}%{gem_extdir_mri} -cp -a .%{gem_extdir_mri}/{gem.build_complete,*.so} %{buildroot}%{gem_extdir_mri}/ +cp -a .%{gem_extdir_mri}/{gem.build_complete,*.so} \ + %{buildroot}%{gem_extdir_mri}/ +# cleanups +pushd %{buildroot}%{gem_instdir} # Prevent dangling symlink in -debuginfo. -rm -rf %{buildroot}%{gem_instdir}/ext +rm -rf \ + Gemfile \ + Rakefile \ + ext/ \ + test/ \ + %{gem_name}.gemspec \ + %{nil} +popd +rm -f %{buildroot}%{gem_cache} %check pushd .%{gem_instdir} -RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test ruby -e 'Dir.glob "./test/**/*_test.rb", &method(:require)' +env \ + RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test \ + ruby -e 'Dir.glob "./test/**/*_test.rb", &method(:require)' popd %files -%dir %{gem_instdir} +%dir %{gem_instdir} +%license %{gem_instdir}/COPYING +%doc %{gem_instdir}/README.markdown + %{_bindir}/redcarpet + %{gem_instdir}/bin %{gem_libdir} %{gem_extdir_mri} -%exclude %{gem_cache} + %{gem_spec} -%license %{gem_instdir}/COPYING -%doc %{gem_instdir}/README.markdown %files doc -%{gem_instdir}/Gemfile -%{gem_instdir}/Rakefile -%{gem_instdir}/test -%{gem_instdir}/%{gem_name}.gemspec %doc %{gem_docdir} https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/8d17959621b7be031769…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (f37). "Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 11:02:15 UTC From b3b9162ae9c566d8022f0e8c2fc9b26cf4629a39 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA <mtasaka(a)fedoraproject.org> Date: Jan 04 2023 01:46:25 +0000 Subject: Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2 --- diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 4cfbf8b..1b7c782 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.3.2 -Release: 23%{?dist} +Release: 24%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 License: MIT and ISC @@ -75,6 +75,9 @@ popd %changelog +* Wed Jan 04 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.3.2-24 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.2 + * Sat Jul 23 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.3.2-23 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/b3b9162ae9c566d8022f…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (f38). "Indentation, some unneeded files cleanup"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 10:59:26 UTC From 8d17959621b7be03176998611d6ef46636e83774 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA <mtasaka(a)fedoraproject.org> Date: Apr 30 2023 05:05:03 +0000 Subject: Indentation, some unneeded files cleanup --- diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index a290c2a..8b4ab30 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -1,29 +1,30 @@ %global gem_name redcarpet -Name: rubygem-%{gem_name} -Version: 3.3.2 -Release: 25%{?dist} -Summary: A fast, safe and extensible Markdown to (X)HTML parser +Name: rubygem-%{gem_name} +Version: 3.3.2 +Release: 25%{?dist} + +Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 -License: MIT and ISC -URL: http://github.com/vmg/redcarpet -Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem -BuildRequires: gcc -BuildRequires: ruby(release) -BuildRequires: rubygems-devel -BuildRequires: ruby-devel -BuildRequires: rubygem(test-unit) +License: MIT and ISC +URL: http://github.com/vmg/redcarpet +Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem + +BuildRequires: gcc +BuildRequires: ruby(release) +BuildRequires: rubygems-devel +BuildRequires: ruby-devel +BuildRequires: rubygem(test-unit) %description A fast, safe and extensible Markdown to (X)HTML parser. +%package doc +Summary: Documentation for %{name} +Requires: %{name} = %{version}-%{release} +BuildArch: noarch -%package doc -Summary: Documentation for %{name} -Requires: %{name} = %{version}-%{release} -BuildArch: noarch - -%description doc +%description doc Documentation for %{name}. %prep @@ -45,32 +46,43 @@ cp -a ./%{_bindir}/* %{buildroot}%{_bindir} chmod 755 %{buildroot}%{_bindir}/redcarpet mkdir -p %{buildroot}%{gem_extdir_mri} -cp -a .%{gem_extdir_mri}/{gem.build_complete,*.so} %{buildroot}%{gem_extdir_mri}/ +cp -a .%{gem_extdir_mri}/{gem.build_complete,*.so} \ + %{buildroot}%{gem_extdir_mri}/ +# cleanups +pushd %{buildroot}%{gem_instdir} # Prevent dangling symlink in -debuginfo. -rm -rf %{buildroot}%{gem_instdir}/ext +rm -rf \ + Gemfile \ + Rakefile \ + ext/ \ + test/ \ + %{gem_name}.gemspec \ + %{nil} +popd +rm -f %{buildroot}%{gem_cache} %check pushd .%{gem_instdir} -RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test ruby -e 'Dir.glob "./test/**/*_test.rb", &method(:require)' +env \ + RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test \ + ruby -e 'Dir.glob "./test/**/*_test.rb", &method(:require)' popd %files -%dir %{gem_instdir} +%dir %{gem_instdir} +%license %{gem_instdir}/COPYING +%doc %{gem_instdir}/README.markdown + %{_bindir}/redcarpet + %{gem_instdir}/bin %{gem_libdir} %{gem_extdir_mri} -%exclude %{gem_cache} + %{gem_spec} -%license %{gem_instdir}/COPYING -%doc %{gem_instdir}/README.markdown %files doc -%{gem_instdir}/Gemfile -%{gem_instdir}/Rakefile -%{gem_instdir}/test -%{gem_instdir}/%{gem_name}.gemspec %doc %{gem_docdir} https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/8d17959621b7be031769…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (f38). "Bacckport upstream patch for CVE-2020-26298 (bug 1915370)"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 10:59:26 UTC From 0bc4066bad9d08a4742ec537dc2df262990308ff Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA <mtasaka(a)fedoraproject.org> Date: Apr 30 2023 10:59:16 +0000 Subject: Bacckport upstream patch for CVE-2020-26298 (bug 1915370) --- diff --git a/redcarpet-3.3.2-CVE-2020-26298.patch b/redcarpet-3.3.2-CVE-2020-26298.patch new file mode 100644 index 0000000..a497676 --- /dev/null +++ b/redcarpet-3.3.2-CVE-2020-26298.patch @@ -0,0 +1,56 @@ +From a699c82292b17c8e6a62e1914d5eccc252272793 Mon Sep 17 00:00:00 2001 +From: Robin Dupret <robin.dupret(a)hey.com> +Date: Tue, 15 Dec 2020 20:57:32 +0100 +Subject: [PATCH] Fix a security issue using `:quote` with `:escape_html` + +Reported by @johan-smits. +--- + CHANGELOG.md | 7 +++++++ + ext/redcarpet/html.c | 9 ++++++++- + lib/redcarpet.rb | 2 +- + redcarpet.gemspec | 4 ++-- + test/markdown_test.rb | 10 ++++++++++ + 5 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/ext/redcarpet/html.c b/ext/redcarpet/html.c +index 805ddd8e..785f780f 100644 +--- a/ext/redcarpet/html.c ++++ b/ext/redcarpet/html.c +@@ -255,8 +255,15 @@ rndr_quote(struct buf *ob, const struct buf *text, void *opaque) + if (!text || !text->size) + return 0; + ++ struct html_renderopt *options = opaque; ++ + BUFPUTSL(ob, "<q>"); +- bufput(ob, text->data, text->size); ++ ++ if (options->flags & HTML_ESCAPE) ++ escape_html(ob, text->data, text->size); ++ else ++ bufput(ob, text->data, text->size); ++ + BUFPUTSL(ob, "</q>"); + + return 1; +diff --git a/test/markdown_test.rb b/test/markdown_test.rb +index 4347be9b..68de1255 100644 +--- a/test/markdown_test.rb ++++ b/test/markdown_test.rb +@@ -220,6 +220,16 @@ def test_quote_flag_works + assert output.include? '<q>quote</q>' + end + ++ def test_quote_flag_honors_escape_html ++ text = 'We are not "<svg/onload=pwned>"' ++ ++ output_enabled = render(text, with: [:quote, :escape_html]) ++ output_disabled = render(text, with: [:quote]) ++ ++ assert_equal "<p>We are not <q><svg/onload=pwned></q></p>\n", output_enabled ++ assert_equal "<p>We are not <q><svg/onload=pwned></q></p>\n", output_disabled ++ end ++ + def test_that_fenced_flag_works + text = <<fenced + This is a simple test diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 8b4ab30..fcfa04c 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,13 +2,21 @@ Name: rubygem-%{gem_name} Version: 3.3.2 -Release: 25%{?dist} +Release: 26%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # https://github.com/vmg/redcarpet/issues/502 License: MIT and ISC URL: http://github.com/vmg/redcarpet Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem +# https://github.com/advisories/GHSA-q3wr-qw3g-3p4h +# https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc2522… +# https://nvd.nist.gov/vuln/detail/CVE-2020-26298 +# Fix a security issue using :quote with :escape_html +# Fixed in 3.5.1 +# A bit modified for 3.3.2 +# Note that 14942b4f5ef8dbaeeff8d9212f098391d7c1fbdc does chomp, reverting this +Patch0: %{gem_name}-3.3.2-CVE-2020-26298.patch BuildRequires: gcc BuildRequires: ruby(release) @@ -29,6 +37,7 @@ Documentation for %{name}. %prep %setup -q -n %{gem_name}-%{version} +%patch -P0 -p1 %build gem build ../%{gem_name}-%{version}.gemspec @@ -87,6 +96,9 @@ popd %changelog +* Sun Apr 30 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.3.2-26 +- Bacckport upstream patch for CVE-2020-26298 (bug 1915370) + * Fri Jan 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/0bc4066bad9d08a4742e…

1 0

sergiopr uploaded esorex-3.13.7.tar.gz for rpms/esorex
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 10:58:47 UTC 8f9a58c3d7e6832ebe6da854fe1fd1dec92fafcea56dd89d5a92908645112026634be8176b5fc3922f079f14a6cbdc2220cf04028ba48b78d8661061c4b58687 esorex-3.13.7.tar.gz https://src.fedoraproject.org/lookaside/pkgs/rpms/esorex/esorex-3.13.7.tar.…

1 0

mtasaka pushed to rpms/rubygem-redcarpet (rawhide). "mention CVE-2020-26298 is fixed"
by notifications＠fedoraproject.org 30 Apr '23

30 Apr '23

Notification time stamped 2023-04-30 10:57:26 UTC From c6d039accb866622db79b6483b1a41523575473c Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA <mtasaka(a)fedoraproject.org> Date: Apr 30 2023 10:57:14 +0000 Subject: mention CVE-2020-26298 is fixed --- diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 1d0fad1..878e0ca 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,9 +94,10 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog -* Sun Apr 30 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.6.0-1 +* Sun Apr 30 2023 Mamoru TASAKA <mtasaka(a)fedoraproject.org> - 3.6.0-2 - 3.6.0 - License changed to MIT (SPDX confimred) +- CVE-2020-26298 is fixed in this version * Fri Jan 20 2023 Fedora Release Engineering <releng(a)fedoraproject.org> - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild https://src.fedoraproject.org/rpms/rubygem-redcarpet/c/c6d039accb866622db79…

1 0

← Newer
1
2
3
4
5
6
7
8
...
2087
Older →

Jump to page:

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

scm-commits April 2023