Projects
Mega:24.09
ruby
Sign Up
Log In
Username
Password
We truncated the diff of some files because they were too big. If you want to see the full diff for every file,
click here
.
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
Expand all
Collapse all
Changes of Revision 2
View file
_service:tar_scm:ruby.spec
Changed
@@ -33,7 +33,7 @@ Name: ruby Version: %{ruby_version} -Release: 141 +Release: 142 Summary: Object-oriented scripting language interpreter License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD URL: https://www.ruby-lang.org/en/ @@ -97,6 +97,7 @@ Patch6021: backport-0003-CVE-2024-35221.patch Patch6022: backport-0004-CVE-2024-35221.patch Patch6023: backport-0005-CVE-2024-35221.patch +Patch6024: upgrade-lib-rexml-to-3.3.1.patch Provides: %{name}-libs = %{version}-%{release} Obsoletes: %{name}-libs < %{version}-%{release} @@ -882,6 +883,9 @@ %{gem_dir}/specifications/matrix-%{matrix_version}.gemspec %changelog +* Sat Jul 06 2024 shixuantong <shixuantong1@huawei.com> - 3.2.2-142 +- upgrade rexml to fix CVE-2024-35176 + * Tue Jun 18 2024 shixuantong <shixuantong1@huawei.com> - 3.2.2-141 - fix CVE-2024-35221
View file
_service:tar_scm:upgrade-lib-rexml-to-3.3.1.patch
Added
@@ -0,0 +1,1824 @@ +From 20017eea807e8fa386aa5c79ae779004d8b366dd Mon Sep 17 00:00:00 2001 +From: Sutou Kouhei <kou@clear-code.com> +Date: Tue, 25 Jun 2024 11:26:33 +0900 +Subject: PATCH Add 3.3.1 entry + +Backport from https://github.com/ruby/rexml/tree/v3.3.1/lib/rexml + +--- + .../gems/rexml-3.2.5/lib/rexml/attribute.rb | 23 +- + .../gems/rexml-3.2.5/lib/rexml/document.rb | 2 +- + .bundle/gems/rexml-3.2.5/lib/rexml/element.rb | 23 +- + .bundle/gems/rexml-3.2.5/lib/rexml/entity.rb | 40 +- + .../lib/rexml/formatters/pretty.rb | 4 +- + .../gems/rexml-3.2.5/lib/rexml/functions.rb | 3 +- + .../gems/rexml-3.2.5/lib/rexml/namespace.rb | 12 +- + .bundle/gems/rexml-3.2.5/lib/rexml/node.rb | 12 +- + .../rexml-3.2.5/lib/rexml/parseexception.rb | 1 + + .../lib/rexml/parsers/baseparser.rb | 521 ++++++++++-------- + .../lib/rexml/parsers/treeparser.rb | 23 +- + .../lib/rexml/parsers/xpathparser.rb | 222 +++++--- + .bundle/gems/rexml-3.2.5/lib/rexml/rexml.rb | 4 +- + .bundle/gems/rexml-3.2.5/lib/rexml/source.rb | 220 ++++---- + .bundle/gems/rexml-3.2.5/lib/rexml/text.rb | 10 +- + .../rexml-3.2.5/lib/rexml/xpath_parser.rb | 10 +- + 16 files changed, 627 insertions(+), 503 deletions(-) + +diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/attribute.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/attribute.rb +index 8933a01..11893a9 100644 +--- a/.bundle/gems/rexml-3.2.5/lib/rexml/attribute.rb ++++ b/.bundle/gems/rexml-3.2.5/lib/rexml/attribute.rb +@@ -1,4 +1,4 @@ +-# frozen_string_literal: false ++# frozen_string_literal: true + require_relative "namespace" + require_relative 'text' + +@@ -13,9 +13,6 @@ module REXML + + # The element to which this attribute belongs + attr_reader :element +- # The normalized value of this attribute. That is, the attribute with +- # entities intact. +- attr_writer :normalized + PATTERN = /\s*(#{NAME_STR})\s*=\s*("')(.*?)\2/um + + NEEDS_A_SECOND_CHECK = /(<|&((#{Entity::NAME});|(#0*((?:\d+)|(?:xa-fA-F0-9+)));)?)/um +@@ -122,10 +119,13 @@ module REXML + # b = Attribute.new( "ns:x", "y" ) + # b.to_string # -> "ns:x='y'" + def to_string ++ value = to_s + if @element and @element.context and @element.context:attribute_quote == :quote +- %Q^#@expanded_name="#{to_s().gsub(/"/, '"')}"^ ++ value = value.gsub('"', '"') if value.include?('"') ++ %Q^#@expanded_name="#{value}"^ + else +- "#@expanded_name='#{to_s().gsub(/'/, ''')}'" ++ value = value.gsub("'", ''') if value.include?("'") ++ "#@expanded_name='#{value}'" + end + end + +@@ -141,7 +141,6 @@ module REXML + return @normalized if @normalized + + @normalized = Text::normalize( @unnormalized, doctype ) +- @unnormalized = nil + @normalized + end + +@@ -150,10 +149,16 @@ module REXML + def value + return @unnormalized if @unnormalized + @unnormalized = Text::unnormalize( @normalized, doctype ) +- @normalized = nil + @unnormalized + end + ++ # The normalized value of this attribute. That is, the attribute with ++ # entities intact. ++ def normalized=(new_normalized) ++ @normalized = new_normalized ++ @unnormalized = nil ++ end ++ + # Returns a copy of this attribute + def clone + Attribute.new self +@@ -190,7 +195,7 @@ module REXML + end + + def inspect +- rv = "" ++ rv = +"" + write( rv ) + rv + end +diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/document.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/document.rb +index 2edeb98..b1caa02 100644 +--- a/.bundle/gems/rexml-3.2.5/lib/rexml/document.rb ++++ b/.bundle/gems/rexml-3.2.5/lib/rexml/document.rb +@@ -69,7 +69,7 @@ module REXML + # d.to_s # => "<root><foo>Foo</foo><bar>Bar</bar></root>" + # + # When argument +document+ is given, it must be an existing +- # document object, whose context and attributes (but not chidren) ++ # document object, whose context and attributes (but not children) + # are cloned into the new document: + # + # d = REXML::Document.new(xml_string) +diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/element.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/element.rb +index 4c21dbd..a5808d7 100644 +--- a/.bundle/gems/rexml-3.2.5/lib/rexml/element.rb ++++ b/.bundle/gems/rexml-3.2.5/lib/rexml/element.rb +@@ -7,14 +7,6 @@ require_relative "xpath" + require_relative "parseexception" + + module REXML +- # An implementation note about namespaces: +- # As we parse, when we find namespaces we put them in a hash and assign +- # them a unique ID. We then convert the namespace prefix for the node +- # to the unique ID. This makes namespace lookup much faster for the +- # cost of extra memory use. We save the namespace prefix for the +- # context node and convert it back when we write it. +- @@namespaces = {} +- + # An \REXML::Element object represents an XML element. + # + # An element: +@@ -989,7 +981,7 @@ module REXML + # :call-seq: + # has_text? -> true or false + # +- # Returns +true if the element has one or more text noded, ++ # Returns +true+ if the element has one or more text noded, + # +false+ otherwise: + # + # d = REXML::Document.new '<a><b/>text<c/></a>' +@@ -1006,7 +998,7 @@ module REXML + # text(xpath = nil) -> text_string or nil + # + # Returns the text string from the first text node child +- # in a specified element, if it exists, # +nil+ otherwise. ++ # in a specified element, if it exists, +nil+ otherwise. + # + # With no argument, returns the text from the first text node in +self+: + # +@@ -1014,7 +1006,7 @@ module REXML + # d.root.text.class # => String + # d.root.text # => "some text " + # +- # With argument +xpath+, returns text from the the first text node ++ # With argument +xpath+, returns text from the first text node + # in the element that matches +xpath+: + # + # d.root.text(1) # => "this is bold!" +@@ -1284,16 +1276,11 @@ module REXML + # document.root.attribute("x", "a") # => a:x='a:x' + # + def attribute( name, namespace=nil ) +- prefix = nil +- if namespaces.respond_to? :key +- prefix = namespaces.key(namespace) if namespace +- else +- prefix = namespaces.index(namespace) if namespace +- end ++ prefix = namespaces.key(namespace) if namespace + prefix = nil if prefix == 'xmlns' + + ret_val = +- attributes.get_attribute( "#{prefix ? prefix + ':' : ''}#{name}" ) ++ attributes.get_attribute( prefix ? "#{prefix}:#{name}" : name ) + + return ret_val unless ret_val.nil? + return nil if prefix.nil? +diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/entity.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/entity.rb +index 89a9e84..573db69 100644 +--- a/.bundle/gems/rexml-3.2.5/lib/rexml/entity.rb ++++ b/.bundle/gems/rexml-3.2.5/lib/rexml/entity.rb +@@ -132,24 +132,34 @@ module REXML + # then: + # doctype.entity('yada').value #-> "nanoo bar nanoo" + def value +- if @value +- matches = @value.scan(PEREFERENCE_RE) +- rv = @value.clone +- if @parent +- sum = 0 +- matches.each do |entity_reference| +- entity_value = @parent.entity( entity_reference0 ) +- if sum + entity_value.bytesize > Security.entity_expansion_text_limit +- raise "entity expansion has grown too large" +- else +- sum += entity_value.bytesize +- end +- rv.gsub!( /%#{entity_reference.join};/um, entity_value ) ++ @resolved_value ||= resolve_value ++ end ++
View file
_service
Changed
@@ -2,7 +2,7 @@ <service name="tar_scm"> <param name="scm">git</param> <param name="url">git@gitee.com:src-openeuler/ruby.git</param> - <param name="revision">master</param> + <param name="revision">openEuler-24.09</param> <param name="exclude">*</param> <param name="extract">*</param> </service>
Locations
Projects
Search
Status Monitor
Help
Open Build Service
OBS Manuals
API Documentation
OBS Portal
Reporting a Bug
Contact
Mailing List
Forums
Chat (IRC)
Twitter
Open Build Service (OBS)
is an
openSUSE project
.
浙ICP备2022010568号-2