开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 20

_service:tar_scm:eclipse.spec Changed

@@ -1,4 +1,4 @@
-%global bootstrap       0
+%global bootstrap       1
 %global eb_commit       c985e357223668b4bc1fb76ea6b9e0c12829b7e8
 %global eclipse_rel     %{version}RC2
 %global eclipse_tag     S-%{eclipse_rel}-201903070500
@@ -402,6 +402,7 @@
 %mvn_package "org.eclipse.ui:org.eclipse.ui.{views.log,trace}" pde
 %mvn_package "org.eclipse.sdk{,.feature}:" sdk
 %mvn_package ":" __noinstall
+sed -i 's/-O -g -Wall -fPIC/-O -g -Wall -fPIC -pie -Wl,-z,relro -Wl,-z,now -fstack-protector-strong/g' eclipse.platform.swt/bundles/org.eclipse.swt/Eclipse\ SWT\ PI/gtk/library/build.sh
 
 %build
 export CFLAGS="%{optflags}"
@@ -764,6 +765,13 @@
 * Wed May 30 2023 Xiang Zhang <zhangxiang@iscas.ac.cn> - 1:4.11-7
 - Add riscv64 support
 
+* Tue Feb 21 2023 liyanan <liyanan32@h-partners.com> - 1:4.11-8
+- Add security compile options pie, relro and -fstack-protector-strong
+- Add glassfish-jsp and glassfish-servlet-api and glassfish-el-api version limit
+
+* Thu Jul 14 2022 wangkai <wangkai385@h-partners.com> - 1:4.11-7
+- Fix CVE-2020-27225
+
 * Tue Jun 21 2022 baizhonggui <baizhonggui@h-partners.com> - 1:4.11-6
 - fixed objectweb.asm version limit

_service:tar_scm:Add_riscv64_support.patch Added

_service:tar_scm:CVE-2020-27225.patch Added

@@ -0,0 +1,354 @@
+From 28aac2514656c669ffa16acb996c77def3d4a8d4 Mon Sep 17 00:00:00 2001
+From: Andrew Johnson
+Date: Tue, 16 Feb 2021 21:40:49 +0000
+Subject: 569855: Fix for Eclipse live help. - Use tokens - Backport to
+ R4_11_maintenance branch
+
+Change-Id: I09cee753dc24d55a2704b80ae13d392d233aac0d
+Task-Url: https://bugs.eclipse.org/bugs/show_bug.cgi?id=569855
+Signed-off-by: Andrew Johnson <andrew_johnson@uk.ibm.com>(cherry picked from commit 90661664f30d4e1225e4a68b179c6ee110cd7f75)
+Also-by: Niraj Modi <niraj.modi@in.ibm.com>
+---
+ org.eclipse.help.base/META-INF/MANIFEST.MF         |  2 +-
+ org.eclipse.help.base/pom.xml                      |  2 +-
+ .../eclipse/help/internal/base/BaseHelpSystem.java | 29 ++++++++++++-
+ .../eclipse/help/internal/base/HelpDisplay.java    | 10 ++++-
+ org.eclipse.help.webapp/META-INF/MANIFEST.MF       |  2 +-
+ org.eclipse.help.webapp/advanced/livehelp_js.jsp   | 12 +++++-
+ org.eclipse.help.webapp/index.jsp                  | 32 ++++++++++++---
+ org.eclipse.help.webapp/pom.xml                    |  2 +-
+ .../help/internal/webapp/data/LayoutData.java      |  7 +++-
+ .../internal/webapp/servlet/LiveHelpServlet.java   | 48 +++++++++++++++++++++-
+ 10 files changed, 129 insertions(+), 17 deletions(-)
+
+diff --git a/org.eclipse.help.base/META-INF/MANIFEST.MF b/org.eclipse.help.base/META-INF/MANIFEST.MF
+index 4ad860070..398a6829a 100644
+--- a/org.eclipse.help.base/META-INF/MANIFEST.MF
++++ b/org.eclipse.help.base/META-INF/MANIFEST.MF
+@@ -2,7 +2,7 @@ Manifest-Version: 1.0
+ Bundle-ManifestVersion: 2
+ Bundle-Name: %help_base_plugin_name
+ Bundle-SymbolicName: org.eclipse.help.base; singleton:=true
+-Bundle-Version: 4.2.500.qualifier
++Bundle-Version: 4.2.501.qualifier
+ Bundle-Activator: org.eclipse.help.internal.base.HelpBasePlugin
+ Bundle-Vendor: %providerName
+ Bundle-Localization: plugin
+diff --git a/org.eclipse.help.base/pom.xml b/org.eclipse.help.base/pom.xml
+index b90d899f6..36f5145e9 100644
+--- a/org.eclipse.help.base/pom.xml
++++ b/org.eclipse.help.base/pom.xml
+@@ -18,7 +18,7 @@
+   </parent>
+   <groupId>org.eclipse.help</groupId>
+   <artifactId>org.eclipse.help.base</artifactId>
+-  <version>4.2.500-SNAPSHOT</version>
++  <version>4.2.501-SNAPSHOT</version>
+   <packaging>eclipse-plugin</packaging>
+   <properties>
+     <defaultSigning-excludeInnerJars>true</defaultSigning-excludeInnerJars>
+diff --git a/org.eclipse.help.base/src/org/eclipse/help/internal/base/BaseHelpSystem.java b/org.eclipse.help.base/src/org/eclipse/help/internal/base/BaseHelpSystem.java
+index 2ea5bf807..f9f09ae7a 100644
+--- a/org.eclipse.help.base/src/org/eclipse/help/internal/base/BaseHelpSystem.java
++++ b/org.eclipse.help.base/src/org/eclipse/help/internal/base/BaseHelpSystem.java
+@@ -1,5 +1,5 @@
+ /*******************************************************************************
+- * Copyright (c) 2000, 2018 IBM Corporation and others.
++ * Copyright (c) 2000, 2021 IBM Corporation and others.
+  *
+  * This program and the accompanying materials
+  * are made available under the terms of the Eclipse Public License 2.0
+@@ -15,6 +15,7 @@ package org.eclipse.help.internal.base;
+ 
+ import java.net.MalformedURLException;
+ import java.net.URL;
++
+ import org.eclipse.core.runtime.CoreException;
+ import org.eclipse.core.runtime.IProduct;
+ import org.eclipse.core.runtime.IStatus;
+@@ -59,6 +60,7 @@ public final class BaseHelpSystem {
+ 	private IBrowser browser;
+ 	private IBrowser internalBrowser;
+ 	private HelpDisplay helpDisplay = null;
++	private String liveHelpToken = null;
+ 
+ 	private BaseHelpSystem() {
+ 		super();
+@@ -350,4 +352,29 @@ public final class BaseHelpSystem {
+ 		}
+ 	}
+ 
++	/**
++	 * Check supplied token against stored token. Clears the stored token if
++	 * successful.
++	 * 
++	 * @param helpSessionToken
++	 * @return true if match successful
++	 */
++	public boolean matchOnceLiveHelpToken(String helpSessionToken) {
++		/*
++		 * @FIXME - should we use a constant time comparison, and store/compare a
++		 * cryptographic hash?
++		 */
++		if (liveHelpToken != null && liveHelpToken.equals(helpSessionToken)) {
++			// Enforce one-time use.
++			liveHelpToken = null;
++			return true;
++		} else {
++			return false;
++		}
++	}
++
++	public void setLiveHelpToken(String helpSessionToken) {
++		liveHelpToken = helpSessionToken;
++	}
++
+ }
+diff --git a/org.eclipse.help.base/src/org/eclipse/help/internal/base/HelpDisplay.java b/org.eclipse.help.base/src/org/eclipse/help/internal/base/HelpDisplay.java
+index 28ebfd10d..33a0e08fd 100644
+--- a/org.eclipse.help.base/src/org/eclipse/help/internal/base/HelpDisplay.java
++++ b/org.eclipse.help.base/src/org/eclipse/help/internal/base/HelpDisplay.java
+@@ -1,5 +1,5 @@
+ /*******************************************************************************
+- * Copyright (c) 2000, 2015 IBM Corporation and others.
++ * Copyright (c) 2000, 2021 IBM Corporation and others.
+  *
+  * This program and the accompanying materials
+  * are made available under the terms of the Eclipse Public License 2.0
+@@ -15,6 +15,8 @@ package org.eclipse.help.internal.base;
+ 
+ import java.io.UnsupportedEncodingException;
+ import java.net.URLEncoder;
++import java.nio.charset.StandardCharsets;
++import java.util.UUID;
+ 
+ import org.eclipse.core.runtime.CoreException;
+ import org.eclipse.core.runtime.IConfigurationElement;
+@@ -196,6 +198,12 @@ public class HelpDisplay {
+ 				String topic = helpURL.substring("topic=".length()); //$NON-NLS-1$
+ 				helpURL = getHelpDisplay().getHelpForTopic( topic, WebappManager.getHost(),  WebappManager.getPort());
+ 			}
++			String basehelp = getBaseURL();
++			if (BaseHelpSystem.getMode() != BaseHelpSystem.MODE_INFOCENTER && helpURL.startsWith(basehelp)) {
++				String sessid = UUID.randomUUID().toString();
++				BaseHelpSystem.getInstance().setLiveHelpToken(sessid);
++				helpURL += (helpURL.indexOf('?') < 0 ? '?' : '&') + "token=" + sessid; //$NON-NLS-1$
++			}
+ 
+ 			BaseHelpSystem.getHelpBrowser(forceExternal)
+ 						.displayURL(helpURL);
+diff --git a/org.eclipse.help.webapp/META-INF/MANIFEST.MF b/org.eclipse.help.webapp/META-INF/MANIFEST.MF
+index 0c85d674e..c943158a6 100644
+--- a/org.eclipse.help.webapp/META-INF/MANIFEST.MF
++++ b/org.eclipse.help.webapp/META-INF/MANIFEST.MF
+@@ -2,7 +2,7 @@ Manifest-Version: 1.0
+ Bundle-ManifestVersion: 2
+ Bundle-Name: %help_webapp_plugin_name
+ Bundle-SymbolicName: org.eclipse.help.webapp;singleton:=true
+-Bundle-Version: 3.9.400.qualifier
++Bundle-Version: 3.9.401.qualifier
+ Bundle-Activator: org.eclipse.help.internal.webapp.HelpWebappPlugin
+ Bundle-Vendor: %providerName
+ Bundle-Localization: plugin
+diff --git a/org.eclipse.help.webapp/advanced/livehelp_js.jsp b/org.eclipse.help.webapp/advanced/livehelp_js.jsp
+index 23362f89e..6d04945d6 100644
+--- a/org.eclipse.help.webapp/advanced/livehelp_js.jsp
++++ b/org.eclipse.help.webapp/advanced/livehelp_js.jsp
+@@ -1,5 +1,5 @@
+ <%--
+- Copyright (c) 2000, 2018 IBM Corporation and others.
++ Copyright (c) 2000, 2021 IBM Corporation and others.
+ 
+  This program and the accompanying materials 
+  are made available under the terms of the Eclipse Public License 2.0
+@@ -47,7 +47,15 @@ function liveActionInternal(topHelpWindow, pluginId, className, argument)
+ 	url=url.substring(0, i+1);
+ 	var encodedArg=encodeURIComponent(argument);
+ 	url=url+"livehelp/?pluginID="+pluginId+"&class="+className+"&arg="+encodedArg+"&nocaching="+Math.random();
+-
++	<%
++	Object token = request.getSession().getAttribute("LSESSION"); //$NON-NLS-1$
++	// Validate token to protect against XSS
++	if (token instanceof String && ((String)token).matches("a-z0-9-{36}")) {//$NON-NLS-1$) {
++	%>
++	url=url+"&token=<%=token%>";
++	<%
++	}
++	%>
+ 	// we need to find the toolbar frame.
+ 	// to do: cleanup this, including the location of the hidden livehelp frame.	
+ 	var toolbarFrame = topHelpWindow.HelpFrame.ContentFrame.ContentToolbarFrame;
+diff --git a/org.eclipse.help.webapp/index.jsp b/org.eclipse.help.webapp/index.jsp
+index 34d3e14ee..76b6564c1 100644
+--- a/org.eclipse.help.webapp/index.jsp
++++ b/org.eclipse.help.webapp/index.jsp
+@@ -1,5 +1,5 @@
+ <%--
+- Copyright (c) 2000, 2011 IBM Corporation and others.
++ Copyright (c) 2000, 2021 IBM Corporation and others.
+ 
+  This program and the accompanying materials 
+  are made available under the terms of the Eclipse Public License 2.0
+@@ -12,9 +12,11 @@
+      IBM Corporation - initial API and implementation
+ --%>
+ <%@ page import="org.eclipse.help.internal.webapp.data.*" errorPage="/advanced/err.jsp" contentType="text/html; charset=UTF-8"%>
++<%@ page import="java.util.UUID" %>
++<%@ page import="org.eclipse.help.internal.base.BaseHelpSystem" %>
+ <%
+ 	request.setCharacterEncoding("UTF-8");