开源软件构建与测试

We truncated the diff of some files because they were too big. If you want to see the full diff for every file, click here.

Changes of Revision 2

_service:tar_scm:snakeyaml.spec Changed

@@ -1,20 +1,23 @@
 #Global macro or variable
-%global vertag 70abb5efa4c0
+%global vertag 49e794037c6b
 
 #Basic Information
 Name:           snakeyaml
-Version:        1.17
-Release:        8
+Version:        1.32
+Release:        1
 Summary:        YAML parser and emitter for the Java programming language
 License:        ASL 2.0
-URL:            https://bitbucket.org/asomov/%{name}/
-Source0:        https://bitbucket.org/asomov/snakeyaml/get/v%{version}.tar.bz2#/%{name}-%{version}.tar.bz2
+URL:            https://bitbucket.org/%{name}/%{name}
+Source0:        https://bitbucket.org/%{name}/%{name}/get/%{name}-%{version}.tar.gz
+Patch0:         0001-replace-bundled-base64coder-with-java.util.Base64.patch
+Patch1:         0002-Replace-bundled-gdata-java-client-classes-with-commo.patch
+Patch2:         reader_bom_test_fix.patch
 BuildArch:      noarch
 
 #Dependency
 BuildRequires:  dos2unix maven-local
-BuildRequires:  mvn(biz.source_code:base64coder) mvn(commons-codec:commons-codec)
-BuildRequires:  mvn(joda-time:joda-time) mvn(org.apache.velocity:velocity)
+BuildRequires:  mvn(commons-codec:commons-codec)
+BuildRequires:  mvn(org.apache.velocity:velocity)
 BuildRequires:  mvn(junit:junit) mvn(org.apache.felix:maven-bundle-plugin)
 BuildRequires:  mvn(org.apache.maven.plugins:maven-source-plugin)
 
@@ -39,7 +42,7 @@
 
 #Build sections
 %prep
-%autosetup -n asomov-%{name}-%{vertag} -p1
+%autosetup -n %{name}-%{name}-%{vertag} -p1
 
 %mvn_file : %{name}
 
@@ -50,19 +53,48 @@
 %pom_remove_plugin :maven-license-plugin
 %pom_remove_plugin :maven-javadoc-plugin
 %pom_remove_plugin :maven-site-plugin
+%pom_remove_plugin :nexus-staging-maven-plugin
 
 sed -i "/<artifactId>spring</s/spring/&-core/" pom.xml
 rm -f src/test/java/examples/SpringTest.java
 
 %pom_add_dep commons-codec:commons-codec
-%pom_add_dep biz.source_code:base64coder
 
-rm -rf target
+%pom_remove_dep joda-time:joda-time
+rm -rf src/test/java/examples/jodatime
+%pom_remove_dep org.projectlombok:lombok
+%pom_remove_dep org.apache.velocity:velocity-engine-core
+
 rm src/test/java/org/yaml/snakeyaml/issues/issue67/NonAsciiCharsInClassNameTest.java
 rm src/test/java/org/yaml/snakeyaml/issues/issue318/ContextClassLoaderTest.java
- 
-%pom_remove_dep org.springframework
-rm -r src/test/java/org/yaml/snakeyaml/issues/issue9
+
+rm src/test/java/org/yaml/snakeyaml/emitter/template/VelocityTest.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue387/YamlExecuteProcessContextTest.java
+rm src/test/java/org/yaml/snakeyaml/env/ApplicationProperties.java
+rm src/test/java/org/yaml/snakeyaml/env/EnvLombokTest.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue527/Fuzzy47047Test.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue530/Fuzzy47039Test.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue543/Fuzzer50355Test.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue525/FuzzyStackOverflowTest.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue529/Fuzzy47028Test.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue531/Fuzzy47081Test.java
+rm src/test/java/org/yaml/snakeyaml/issues/issue526/Fuzzy47027Test.java
+
+rm src/test/resources/issues/issue99.jpeg
+rm src/test/resources/reader/unicode-16be.txt
+rm src/test/resources/reader/unicode-16le.txt
+rm src/test/resources/pyyaml/spec-05-01-utf16be.data
+rm src/test/resources/pyyaml/spec-05-01-utf16le.data
+rm src/test/resources/pyyaml/spec-05-02-utf16le.data
+rm src/test/resources/pyyaml/odd-utf16.stream-error
+rm src/test/resources/pyyaml/invalid-character.loader-error
+rm src/test/resources/pyyaml/invalid-character.stream-error
+rm src/test/resources/pyyaml/invalid-utf8-byte.loader-error
+rm src/test/resources/pyyaml/invalid-utf8-byte.stream-error
+rm src/test/resources/pyyaml/empty-document-bug.data
+rm src/test/resources/pyyaml/spec-05-02-utf16be.data
+rm -rf src/test/resources/fuzzer/
+rm src/test/java/org/yaml/snakeyaml/issues/issue99/YamlBase64Test.java
 
 %build
 %mvn_build
@@ -78,6 +110,9 @@
 %license LICENSE.txt
 
 %changelog
+* Wed Mar 08 2023 yaoxin <yaoxin30@h-partners.com> - 1.32-1
+- Update to 1.32 for fix CVE-2022-41854,CVE-2022-25857 and CVE-2022-38749-to-CVE-2022-38752
+
 * Tue Feb 11 2020 Jiangping Hu <hujp1985@foxmail.com> - 1.17-8
 - Package init

_service:tar_scm:0001-replace-bundled-base64coder-with-java.util.Base64.patch Added

@@ -0,0 +1,418 @@
+diff --git a/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java b/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java
+index b34011c..b549448 100644
+--- a/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java
++++ b/src/main/java/org/yaml/snakeyaml/constructor/SafeConstructor.java
+@@ -15,6 +15,7 @@ package org.yaml.snakeyaml.constructor;
+ 
+ import java.math.BigInteger;
+ import java.util.ArrayList;
++import java.util.Base64;
+ import java.util.Calendar;
+ import java.util.HashMap;
+ import java.util.Iterator;
+@@ -28,7 +29,6 @@ import java.util.regex.Matcher;
+ import java.util.regex.Pattern;
+ import org.yaml.snakeyaml.LoaderOptions;
+ import org.yaml.snakeyaml.error.YAMLException;
+-import org.yaml.snakeyaml.external.biz.base64Coder.Base64Coder;
+ import org.yaml.snakeyaml.nodes.MappingNode;
+ import org.yaml.snakeyaml.nodes.Node;
+ import org.yaml.snakeyaml.nodes.NodeId;
+@@ -385,7 +385,7 @@ public class SafeConstructor extends BaseConstructor {
+     public Object construct(Node node) {
+       // Ignore white spaces for base64 encoded scalar
+       String noWhiteSpaces = constructScalar((ScalarNode) node).replaceAll("\\s", "");
+-      byte decoded = Base64Coder.decode(noWhiteSpaces.toCharArray());
++      byte decoded = Base64.getDecoder().decode(noWhiteSpaces);
+       return decoded;
+     }
+   }
+diff --git a/src/main/java/org/yaml/snakeyaml/external/biz/base64Coder/Base64Coder.java b/src/main/java/org/yaml/snakeyaml/external/biz/base64Coder/Base64Coder.java
+deleted file mode 100644
+index db43b47..0000000
+--- a/src/main/java/org/yaml/snakeyaml/external/biz/base64Coder/Base64Coder.java
++++ /dev/null
+@@ -1,281 +0,0 @@
+-// Copyright 2003-2010 Christian d'Heureuse, Inventec Informatik AG, Zurich, Switzerland
+-// www.source-code.biz, www.inventec.ch/chdh
+-//
+-// This module is multi-licensed and may be used under the terms
+-// of any of the following licenses:
+-//
+-// EPL, Eclipse Public License, V1.0 or later, http://www.eclipse.org/legal
+-// LGPL, GNU Lesser General Public License, V2.1 or later, http://www.gnu.org/licenses/lgpl.html
+-// GPL, GNU General Public License, V2 or later, http://www.gnu.org/licenses/gpl.html
+-// AL, Apache License, V2.0 or later, http://www.apache.org/licenses
+-// BSD, BSD License, http://www.opensource.org/licenses/bsd-license.php
+-//
+-// Please contact the author if you need another license.
+-// This module is provided "as is", without warranties of any kind.
+-
+-package org.yaml.snakeyaml.external.biz.base64Coder;
+-
+-/**
+- * A Base64 encoder/decoder.
+- *
+- * <p>
+- * This class is used to encode and decode data in Base64 format as described in RFC 1521.
+- *
+- * <p>
+- * Project home page: <a href="http://www.source-code.biz/base64coder/java/">www.
+- * source-code.biz/base64coder/java</a><br>
+- * Author: Christian d'Heureuse, Inventec Informatik AG, Zurich, Switzerland<br>
+- * Multi-licensed: EPL / LGPL / GPL / AL / BSD.
+- */
+-public class Base64Coder {
+-
+-  // The line separator string of the operating system.
+-  private static final String systemLineSeparator = System.getProperty("line.separator");
+-
+-  // Mapping table from 6-bit nibbles to Base64 characters.
+-  private static final char map1 = new char64;
+-
+-  static {
+-    int i = 0;
+-    for (char c = 'A'; c <= 'Z'; c++) {
+-      map1i++ = c;
+-    }
+-    for (char c = 'a'; c <= 'z'; c++) {
+-      map1i++ = c;
+-    }
+-    for (char c = '0'; c <= '9'; c++) {
+-      map1i++ = c;
+-    }
+-    map1i++ = '+';
+-    map1i++ = '/';
+-  }
+-
+-  // Mapping table from Base64 characters to 6-bit nibbles.
+-  private static final byte map2 = new byte128;
+-
+-  static {
+-    for (int i = 0; i < map2.length; i++) {
+-      map2i = -1;
+-    }
+-    for (int i = 0; i < 64; i++) {
+-      map2map1i = (byte) i;
+-    }
+-  }
+-
+-  /**
+-   * Encodes a string into Base64 format. No blanks or line breaks are inserted.
+-   *
+-   * @param s A String to be encoded.
+-   * @return A String containing the Base64 encoded data.
+-   */
+-  public static String encodeString(String s) {
+-    return new String(encode(s.getBytes()));
+-  }
+-
+-  /**
+-   * Encodes a byte array into Base 64 format and breaks the output into lines of 76 characters.
+-   * This method is compatible with <code>sun.misc.BASE64Encoder.encodeBuffer(byte)</code>.
+-   *
+-   * @param in An array containing the data bytes to be encoded.
+-   * @return A String containing the Base64 encoded data, broken into lines.
+-   */
+-  public static String encodeLines(byte in) {
+-    return encodeLines(in, 0, in.length, 76, systemLineSeparator);
+-  }
+-
+-  /**
+-   * Encodes a byte array into Base 64 format and breaks the output into lines.
+-   *
+-   * @param in An array containing the data bytes to be encoded.
+-   * @param iOff Offset of the first byte in <code>in</code> to be processed.
+-   * @param iLen Number of bytes to be processed in <code>in</code>, starting at <code>iOff</code>.
+-   * @param lineLen Line length for the output data. Should be a multiple of 4.
+-   * @param lineSeparator The line separator to be used to separate the output lines.
+-   * @return A String containing the Base64 encoded data, broken into lines.
+-   */
+-  public static String encodeLines(byte in, int iOff, int iLen, int lineLen,
+-      String lineSeparator) {
+-    int blockLen = (lineLen * 3) / 4;
+-    if (blockLen <= 0) {
+-      throw new IllegalArgumentException();
+-    }
+-    int lines = (iLen + blockLen - 1) / blockLen;
+-    int bufLen = ((iLen + 2) / 3) * 4 + lines * lineSeparator.length();
+-    StringBuilder buf = new StringBuilder(bufLen);
+-    int ip = 0;
+-    while (ip < iLen) {
+-      int l = Math.min(iLen - ip, blockLen);
+-      buf.append(encode(in, iOff + ip, l));
+-      buf.append(lineSeparator);
+-      ip += l;
+-    }
+-    return buf.toString();
+-  }
+-
+-  /**
+-   * Encodes a byte array into Base64 format. No blanks or line breaks are inserted in the output.
+-   *
+-   * @param in An array containing the data bytes to be encoded.
+-   * @return A character array containing the Base64 encoded data.
+-   */
+-  public static char encode(byte in) {
+-    return encode(in, 0, in.length);
+-  }
+-
+-  /**
+-   * Encodes a byte array into Base64 format. No blanks or line breaks are inserted in the output.
+-   *
+-   * @param in An array containing the data bytes to be encoded.
+-   * @param iLen Number of bytes to process in <code>in</code>.
+-   * @return A character array containing the Base64 encoded data.
+-   */
+-  public static char encode(byte in, int iLen) {
+-    return encode(in, 0, iLen);
+-  }
+-
+-  /**
+-   * Encodes a byte array into Base64 format. No blanks or line breaks are inserted in the output.
+-   *
+-   * @param in An array containing the data bytes to be encoded.
+-   * @param iOff Offset of the first byte in <code>in</code> to be processed.
+-   * @param iLen Number of bytes to process in <code>in</code>, starting at <code>iOff</code>.
+-   * @return A character array containing the Base64 encoded data.
+-   */
+-  public static char encode(byte in, int iOff, int iLen) {
+-    int oDataLen = (iLen * 4 + 2) / 3; // output length without padding
+-    int oLen = ((iLen + 2) / 3) * 4; // output length including padding
+-    char out = new charoLen;
+-    int ip = iOff;
+-    int iEnd = iOff + iLen;
+-    int op = 0;
+-    while (ip < iEnd) {
+-      int i0 = inip++ & 0xff;
+-      int i1 = ip < iEnd ? inip++ & 0xff : 0;
+-      int i2 = ip < iEnd ? inip++ & 0xff : 0;
+-      int o0 = i0 >>> 2;
+-      int o1 = ((i0 & 3) << 4) | (i1 >>> 4);
+-      int o2 = ((i1 & 0xf) << 2) | (i2 >>> 6);
+-      int o3 = i2 & 0x3F;
+-      outop++ = map1o0;
+-      outop++ = map1o1;
+-      outop = op < oDataLen ? map1o2 : '=';
+-      op++;
+-      outop = op < oDataLen ? map1o3 : '=';
+-      op++;

_service:tar_scm:0002-Replace-bundled-gdata-java-client-classes-with-commo.patch Added

@@ -0,0 +1,60 @@
+diff --git a/src/main/java/org/yaml/snakeyaml/util/UriEncoder.java b/src/main/java/org/yaml/snakeyaml/util/UriEncoder.java
+index 02c3e43..5ccb842 100644
+--- a/src/main/java/org/yaml/snakeyaml/util/UriEncoder.java
++++ b/src/main/java/org/yaml/snakeyaml/util/UriEncoder.java
+@@ -22,18 +22,33 @@ import java.nio.charset.CharsetDecoder;
+ import java.nio.charset.CodingErrorAction;
+ import java.nio.charset.StandardCharsets;
+ import org.yaml.snakeyaml.error.YAMLException;
+-import org.yaml.snakeyaml.external.com.google.gdata.util.common.base.Escaper;
+-import org.yaml.snakeyaml.external.com.google.gdata.util.common.base.PercentEscaper;
++import java.util.BitSet;
++ 
++import org.apache.commons.codec.net.URLCodec;
+ 
+ public abstract class UriEncoder {
+ 
++  // default safe characters which can appear within URI and shouldn't be escaped
++  private static final BitSet allowedCharacters = new BitSet(256);
++
++  static {
++      for (int i = 'a'; i <= 'z'; i++) {
++          allowedCharacters.set(i);
++      }
++      for (int i = 'A'; i <= 'Z'; i++) {
++          allowedCharacters.set(i);
++      }
++      for (int i = '0'; i <= '9'; i++) {
++          allowedCharacters.set(i);
++      }
++      // http://yaml.org/spec/1.1/#escaping%20in%20URI/
++      for (char c : "-_.!~*'()@:$&,;=/".toCharArray()) {
++          allowedCharacters.set(c);
++      }
++  }
++
+   private static final CharsetDecoder UTF8Decoder =
+       StandardCharsets.UTF_8.newDecoder().onMalformedInput(CodingErrorAction.REPORT);
+-  // Include the  chars to the SAFEPATHCHARS_URLENCODER to avoid
+-  // its escape as required by spec. See
+-  // http://yaml.org/spec/1.1/#escaping%20in%20URI/
+-  private static final String SAFE_CHARS = PercentEscaper.SAFEPATHCHARS_URLENCODER + "/";
+-  private static final Escaper escaper = new PercentEscaper(SAFE_CHARS, false);
+ 
+   /**
+    * Escape special characters with '%'
+@@ -42,7 +57,13 @@ public abstract class UriEncoder {
+    * @return encoded URI
+    */
+   public static String encode(String uri) {
+-    return escaper.escape(uri);
++      try {
++          byte rawdata = URLCodec.encodeUrl(allowedCharacters,
++                  uri.getBytes("UTF-8"));
++          return new String(rawdata, 0, rawdata.length, "US-ASCII");
++      } catch (UnsupportedEncodingException e) {
++          throw new YAMLException(e);
++      }
+   }
+ 
+   /**

_service:tar_scm:reader_bom_test_fix.patch Added

@@ -0,0 +1,46 @@
+diff --git a/src/test/java/org/yaml/snakeyaml/reader/ReaderBomTest.java b/src/test/java/org/yaml/snakeyaml/reader/ReaderBomTest.java
+index c7396c2..375bb75 100644
+--- a/src/test/java/org/yaml/snakeyaml/reader/ReaderBomTest.java
++++ b/src/test/java/org/yaml/snakeyaml/reader/ReaderBomTest.java
+@@ -77,41 +77,4 @@ public class ReaderBomTest extends TestCase {
+     input.close();
+   }
+ 
+-  public void testUnicodeLeBom() throws IOException {
+-    File file = new File("src/test/resources/reader/unicode-16le.txt");
+-    assertTrue("Test file not found: " + file.getAbsolutePath(), file.exists());
+-    InputStream input = new FileInputStream(file);
+-    UnicodeReader unicodeReader = new UnicodeReader(input);
+-    StreamReader reader = new StreamReader(unicodeReader);
+-    assertEquals('t', reader.peek());
+-    reader.forward(1);
+-    assertEquals('e', reader.peek());
+-    reader.forward(1);
+-    assertEquals('s', reader.peek());
+-    reader.forward(1);
+-    assertEquals('t', reader.peek());
+-    reader.forward(1);
+-    assertEquals('\u0000', reader.peek());
+-    assertEquals(StandardCharsets.UTF_16LE, Charset.forName(unicodeReader.getEncoding()));
+-    input.close();
+-  }
+-
+-  public void testUnicodeBeBom() throws IOException {
+-    File file = new File("src/test/resources/reader/unicode-16be.txt");
+-    assertTrue("Test file not found: " + file.getAbsolutePath(), file.exists());
+-    InputStream input = new FileInputStream(file);
+-    UnicodeReader unicodeReader = new UnicodeReader(input);
+-    StreamReader reader = new StreamReader(unicodeReader);
+-    assertEquals('t', reader.peek());
+-    reader.forward(1);
+-    assertEquals('e', reader.peek());
+-    reader.forward(1);
+-    assertEquals('s', reader.peek());
+-    reader.forward(1);
+-    assertEquals('t', reader.peek());
+-    reader.forward(1);
+-    assertEquals('\u0000', reader.peek());
+-    assertEquals(StandardCharsets.UTF_16BE, Charset.forName(unicodeReader.getEncoding()));
+-    input.close();
+-  }
+ }

_service Changed

_service:tar_scm:snakeyaml-1.17.tar.bz2 -> _service:tar_scm:snakeyaml-1.32.tar.gz Changed