Complete Yocto mirror with license table for TQMa6UL (2038-compliance)
- 264 license table entries with exact download URLs (224/264 resolved) - Complete sources/ directory with all BitBake recipes - Build configuration: tqma6ul-multi-mba6ulx, spaetzle (musl) - Full traceability for Softwarefreigabeantrag - GCC 13.4.0, Linux 6.6.102, U-Boot 2023.04, musl 1.2.4 - License distribution: GPL-2.0 (24), MIT (23), GPL-2.0+ (18), BSD-3 (16)
This commit is contained in:
@@ -0,0 +1,34 @@
|
||||
From a6e12b25a54d112c899b70c89c0bec9c5e5ebf3c Mon Sep 17 00:00:00 2001
|
||||
From: =?UTF-8?q?Andr=C3=A9=20Draszik?= <andre.draszik@jci.com>
|
||||
Date: Mon, 30 Sep 2019 16:57:01 +0100
|
||||
Subject: [PATCH 1/3] extmk: fix cross-compilation of external gems
|
||||
MIME-Version: 1.0
|
||||
Content-Type: text/plain; charset=UTF-8
|
||||
Content-Transfer-Encoding: 8bit
|
||||
|
||||
Note that I (André) didn't actually write this patch, I
|
||||
only updated it so that git-am works.
|
||||
|
||||
Upstream-Status: Pending
|
||||
Signed-off-by: André Draszik <andre.draszik@jci.com>
|
||||
---
|
||||
ext/extmk.rb | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/ext/extmk.rb b/ext/extmk.rb
|
||||
index 1389dc4117..e4d923d7a7 100755
|
||||
--- a/ext/extmk.rb
|
||||
+++ b/ext/extmk.rb
|
||||
@@ -413,8 +413,8 @@ def $mflags.defined?(var)
|
||||
end
|
||||
$ruby = [$ruby]
|
||||
$ruby << "-I'$(topdir)'"
|
||||
+$ruby << "-I'$(top_srcdir)/lib'"
|
||||
unless CROSS_COMPILING
|
||||
- $ruby << "-I'$(top_srcdir)/lib'"
|
||||
$ruby << "-I'$(extout)/$(arch)'" << "-I'$(extout)/common'" if $extout
|
||||
ENV["RUBYLIB"] = "-"
|
||||
end
|
||||
--
|
||||
2.23.0.rc1
|
||||
|
||||
@@ -0,0 +1,34 @@
|
||||
From dfb22e4d6662bf72879eda806eaa78c7b52b519e Mon Sep 17 00:00:00 2001
|
||||
From: Khem Raj <raj.khem@gmail.com>
|
||||
Date: Tue, 25 Jan 2022 20:29:14 -0800
|
||||
Subject: [PATCH] vm_dump.c: Define REG_S1 and REG_S2 for musl/riscv
|
||||
|
||||
These defines are missing in musl, there is a possible
|
||||
patch to add them to musl, but we need a full list of
|
||||
these names for mcontext that can be added once for all
|
||||
|
||||
Upstream-Status: Inappropriate [musl bug]
|
||||
Signed-off-by: Khem Raj <raj.khem@gmail.com>
|
||||
---
|
||||
vm_dump.c | 5 +++++
|
||||
1 file changed, 5 insertions(+)
|
||||
|
||||
diff --git a/vm_dump.c b/vm_dump.c
|
||||
index a98f5aa..957b785 100644
|
||||
--- a/vm_dump.c
|
||||
+++ b/vm_dump.c
|
||||
@@ -39,6 +39,11 @@
|
||||
|
||||
#define MAX_POSBUF 128
|
||||
|
||||
+#if defined(__riscv) && !defined(__GLIBC__)
|
||||
+# define REG_S1 9
|
||||
+# define REG_S2 18
|
||||
+#endif
|
||||
+
|
||||
#define VM_CFP_CNT(ec, cfp) \
|
||||
((rb_control_frame_t *)((ec)->vm_stack + (ec)->vm_stack_size) - \
|
||||
(rb_control_frame_t *)(cfp))
|
||||
--
|
||||
2.35.0
|
||||
|
||||
@@ -0,0 +1,35 @@
|
||||
From: Christian Hofstaedtler <zeha@debian.org>
|
||||
Date: Tue, 10 Oct 2017 15:04:34 -0300
|
||||
Subject: rdoc: build reproducible documentation
|
||||
|
||||
- provide a fixed timestamp to the gzip compression
|
||||
|
||||
Upstream-Status: Backport [debian]
|
||||
|
||||
Signed-off-by: Antonio Terceiro <terceiro@debian.org>
|
||||
Signed-off-by: Christian Hofstaedtler <zeha@debian.org>
|
||||
---
|
||||
lib/rdoc/generator/json_index.rb | 4 ++--
|
||||
lib/rdoc/rdoc.rb | 2 +-
|
||||
2 files changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
--- a/lib/rdoc/generator/json_index.rb
|
||||
+++ b/lib/rdoc/generator/json_index.rb
|
||||
@@ -178,7 +178,7 @@
|
||||
debug_msg "Writing gzipped search index to %s" % outfile
|
||||
|
||||
Zlib::GzipWriter.open(outfile) do |gz|
|
||||
- gz.mtime = File.mtime(search_index_file)
|
||||
+ gz.mtime = -1
|
||||
gz.orig_name = search_index_file.basename.to_s
|
||||
gz.write search_index
|
||||
gz.close
|
||||
@@ -196,7 +196,7 @@
|
||||
debug_msg "Writing gzipped file to %s" % outfile
|
||||
|
||||
Zlib::GzipWriter.open(outfile) do |gz|
|
||||
- gz.mtime = File.mtime(dest)
|
||||
+ gz.mtime = -1
|
||||
gz.orig_name = dest.basename.to_s
|
||||
gz.write data
|
||||
gz.close
|
||||
@@ -0,0 +1,28 @@
|
||||
From: Reiner Herrmann <reiner@reiner-h.de>
|
||||
Date: Tue, 10 Oct 2017 15:06:13 -0300
|
||||
Subject: lib/mkmf.rb: sort list of object files in generated Makefile
|
||||
|
||||
Without sorting the list explicitly, its order is indeterministic,
|
||||
because readdir() is also not deterministic.
|
||||
When the list of object files varies between builds, they are linked
|
||||
in a different order, which results in an unreproducible build.
|
||||
|
||||
Upstream-Status: Backport [debian]
|
||||
|
||||
Signed-off-by: Antonio Terceiro <terceiro@debian.org>
|
||||
Signed-off-by: Reiner Herrmann <reiner@reiner-h.de>
|
||||
---
|
||||
lib/mkmf.rb | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
--- a/lib/mkmf.rb
|
||||
+++ b/lib/mkmf.rb
|
||||
@@ -2315,7 +2315,7 @@
|
||||
LIBS = #{$LIBRUBYARG} #{$libs} #{$LIBS}
|
||||
ORIG_SRCS = #{orig_srcs.collect(&File.method(:basename)).join(' ')}
|
||||
SRCS = $(ORIG_SRCS) #{(srcs - orig_srcs).collect(&File.method(:basename)).join(' ')}
|
||||
-OBJS = #{$objs.join(" ")}
|
||||
+OBJS = #{$objs.sort.join(" ")}
|
||||
HDRS = #{hdrs.map{|h| '$(srcdir)/' + File.basename(h)}.join(' ')}
|
||||
LOCAL_HDRS = #{$headers.join(' ')}
|
||||
TARGET = #{target}
|
||||
@@ -0,0 +1,31 @@
|
||||
From 6e1dc610724a7aa8368cbcddf4bbe21cccc0f731 Mon Sep 17 00:00:00 2001
|
||||
From: Lucas Kanashiro <kanashiro@debian.org>
|
||||
Date: Fri, 1 Nov 2019 15:25:17 -0300
|
||||
Subject: [PATCH] Make gemspecs reproducible
|
||||
|
||||
Without an explicit date, they will get the current date and make the
|
||||
build unreproducible
|
||||
|
||||
Upstream-Status: Backport [debian]
|
||||
---
|
||||
lib/rubygems/specification.rb | 4 +++-
|
||||
1 file changed, 3 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/rubygems/specification.rb b/lib/rubygems/specification.rb
|
||||
index d6eac7f..4b2e95e 100644
|
||||
--- a/lib/rubygems/specification.rb
|
||||
+++ b/lib/rubygems/specification.rb
|
||||
@@ -1707,7 +1707,9 @@ class Gem::Specification < Gem::BasicSpecification
|
||||
raise(Gem::InvalidSpecificationException,
|
||||
"invalid date format in specification: #{date.inspect}")
|
||||
end
|
||||
- when Time, DateLike then
|
||||
+ when Time then
|
||||
+ Time.utc(date.utc.year, date.utc.month, date.utc.day)
|
||||
+ when DateLike then
|
||||
Time.utc(date.year, date.month, date.day)
|
||||
else
|
||||
TODAY
|
||||
--
|
||||
2.40.0
|
||||
|
||||
@@ -0,0 +1,80 @@
|
||||
From 3f60710bc29c1b08e128314d40101e87b7d2c9a1 Mon Sep 17 00:00:00 2001
|
||||
From: Lucas Kanashiro <kanashiro@debian.org>
|
||||
Date: Fri, 1 Nov 2019 15:25:17 -0300
|
||||
Subject: [PATCH] Make gemspecs reproducible
|
||||
|
||||
Without an explicit date, they will get the current date and make the
|
||||
build unreproducible
|
||||
|
||||
Upstream-Status: Backport [debian]
|
||||
---
|
||||
ext/bigdecimal/bigdecimal.gemspec | 1 +
|
||||
ext/fiddle/fiddle.gemspec | 1 +
|
||||
ext/io/console/io-console.gemspec | 1 +
|
||||
lib/ipaddr.gemspec | 1 +
|
||||
lib/rdoc/rdoc.gemspec | 1 +
|
||||
5 files changed, 5 insertions(+)
|
||||
|
||||
diff --git a/ext/bigdecimal/bigdecimal.gemspec b/ext/bigdecimal/bigdecimal.gemspec
|
||||
index f9f3b45..b9a469d 100644
|
||||
--- a/ext/bigdecimal/bigdecimal.gemspec
|
||||
+++ b/ext/bigdecimal/bigdecimal.gemspec
|
||||
@@ -14,6 +14,7 @@ Gem::Specification.new do |s|
|
||||
s.name = name
|
||||
s.version = source_version
|
||||
s.authors = ["Kenta Murata", "Zachary Scott", "Shigeo Kobayashi"]
|
||||
+ s.date = RUBY_RELEASE_DATE
|
||||
s.email = ["mrkn@mrkn.jp"]
|
||||
|
||||
s.summary = "Arbitrary-precision decimal floating-point number library."
|
||||
diff --git a/ext/fiddle/fiddle.gemspec b/ext/fiddle/fiddle.gemspec
|
||||
index 8781093..efdca32 100644
|
||||
--- a/ext/fiddle/fiddle.gemspec
|
||||
+++ b/ext/fiddle/fiddle.gemspec
|
||||
@@ -8,6 +8,7 @@ end
|
||||
Gem::Specification.new do |spec|
|
||||
spec.name = "fiddle"
|
||||
spec.version = version_module::Fiddle::VERSION
|
||||
+ spec.date = RUBY_RELEASE_DATE
|
||||
spec.authors = ["Aaron Patterson", "SHIBATA Hiroshi"]
|
||||
spec.email = ["aaron@tenderlovemaking.com", "hsbt@ruby-lang.org"]
|
||||
|
||||
diff --git a/ext/io/console/io-console.gemspec b/ext/io/console/io-console.gemspec
|
||||
index d4f5276..8f89611 100644
|
||||
--- a/ext/io/console/io-console.gemspec
|
||||
+++ b/ext/io/console/io-console.gemspec
|
||||
@@ -4,6 +4,7 @@ _VERSION = "0.7.1"
|
||||
Gem::Specification.new do |s|
|
||||
s.name = "io-console"
|
||||
s.version = _VERSION
|
||||
+ s.date = RUBY_RELEASE_DATE
|
||||
s.summary = "Console interface"
|
||||
s.email = "nobu@ruby-lang.org"
|
||||
s.description = "add console capabilities to IO instances."
|
||||
diff --git a/lib/ipaddr.gemspec b/lib/ipaddr.gemspec
|
||||
index 1f4798e..48743cf 100644
|
||||
--- a/lib/ipaddr.gemspec
|
||||
+++ b/lib/ipaddr.gemspec
|
||||
@@ -18,6 +18,7 @@ end
|
||||
Gem::Specification.new do |spec|
|
||||
spec.name = "ipaddr"
|
||||
spec.version = version
|
||||
+ spec.date = RUBY_RELEASE_DATE
|
||||
spec.authors = ["Akinori MUSHA", "Hajimu UMEMOTO"]
|
||||
spec.email = ["knu@idaemons.org", "ume@mahoroba.org"]
|
||||
|
||||
diff --git a/lib/rdoc/rdoc.gemspec b/lib/rdoc/rdoc.gemspec
|
||||
index 93a281c..cc5c155 100644
|
||||
--- a/lib/rdoc/rdoc.gemspec
|
||||
+++ b/lib/rdoc/rdoc.gemspec
|
||||
@@ -7,6 +7,7 @@ end
|
||||
|
||||
Gem::Specification.new do |s|
|
||||
s.name = "rdoc"
|
||||
+ s.date = RUBY_RELEASE_DATE
|
||||
s.version = RDoc::VERSION
|
||||
|
||||
s.authors = [
|
||||
--
|
||||
2.40.0
|
||||
|
||||
@@ -0,0 +1,31 @@
|
||||
From 9907b76dad0777ee300de236dad4b559e07596ab Mon Sep 17 00:00:00 2001
|
||||
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
||||
Date: Fri, 21 Feb 2025 16:01:17 +0900
|
||||
Subject: [PATCH] Use String#concat instead of String#+ for reducing cpu usage
|
||||
|
||||
Co-authored-by: "Yusuke Endoh" <mame@ruby-lang.org>
|
||||
|
||||
Upstream-Status: Backport [https://github.com/ruby/cgi/commit/9907b76dad0777ee300de236dad4b559e07596ab]
|
||||
CVE: CVE-2025-27219
|
||||
Signed-off-by: Ashish Sharma <asharma@mvista.com>
|
||||
|
||||
lib/cgi/cookie.rb | 5 +++--
|
||||
1 file changed, 3 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb
|
||||
index 9498e2f..1c4ef6a 100644
|
||||
--- a/lib/cgi/cookie.rb
|
||||
+++ b/lib/cgi/cookie.rb
|
||||
@@ -190,9 +190,10 @@ def self.parse(raw_cookie)
|
||||
values ||= ""
|
||||
values = values.split('&').collect{|v| CGI.unescape(v,@@accept_charset) }
|
||||
if cookies.has_key?(name)
|
||||
- values = cookies[name].value + values
|
||||
+ cookies[name].concat(values)
|
||||
+ else
|
||||
+ cookies[name] = Cookie.new(name, *values)
|
||||
end
|
||||
- cookies[name] = Cookie.new(name, *values)
|
||||
end
|
||||
|
||||
cookies
|
||||
@@ -0,0 +1,78 @@
|
||||
From cd1eb08076c8b8e310d4d553d427763f2577a1b6 Mon Sep 17 00:00:00 2001
|
||||
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
||||
Date: Fri, 21 Feb 2025 15:53:31 +0900
|
||||
Subject: [PATCH] Escape/unescape unclosed tags as well
|
||||
|
||||
Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
|
||||
|
||||
CVE: CVE-2025-27220
|
||||
|
||||
Upstream-Status: Backport [https://github.com/ruby/cgi/commit/cd1eb08076c8b8e310d4d553d427763f2577a1b6]
|
||||
|
||||
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
||||
---
|
||||
lib/cgi/util.rb | 4 ++--
|
||||
test/cgi/test_cgi_util.rb | 18 ++++++++++++++++++
|
||||
2 files changed, 20 insertions(+), 2 deletions(-)
|
||||
|
||||
diff --git a/lib/cgi/util.rb b/lib/cgi/util.rb
|
||||
index 4986e54..5f12eae 100644
|
||||
--- a/lib/cgi/util.rb
|
||||
+++ b/lib/cgi/util.rb
|
||||
@@ -184,7 +184,7 @@ module CGI::Util
|
||||
def escapeElement(string, *elements)
|
||||
elements = elements[0] if elements[0].kind_of?(Array)
|
||||
unless elements.empty?
|
||||
- string.gsub(/<\/?(?:#{elements.join("|")})(?!\w)(?:.|\n)*?>/i) do
|
||||
+ string.gsub(/<\/?(?:#{elements.join("|")})\b[^<>]*+>?/im) do
|
||||
CGI.escapeHTML($&)
|
||||
end
|
||||
else
|
||||
@@ -204,7 +204,7 @@ module CGI::Util
|
||||
def unescapeElement(string, *elements)
|
||||
elements = elements[0] if elements[0].kind_of?(Array)
|
||||
unless elements.empty?
|
||||
- string.gsub(/<\/?(?:#{elements.join("|")})(?!\w)(?:.|\n)*?>/i) do
|
||||
+ string.gsub(/<\/?(?:#{elements.join("|")})\b(?>[^&]+|&(?![gl]t;)\w+;)*(?:>)?/im) do
|
||||
unescapeHTML($&)
|
||||
end
|
||||
else
|
||||
diff --git a/test/cgi/test_cgi_util.rb b/test/cgi/test_cgi_util.rb
|
||||
index b0612fc..bff77f7 100644
|
||||
--- a/test/cgi/test_cgi_util.rb
|
||||
+++ b/test/cgi/test_cgi_util.rb
|
||||
@@ -269,6 +269,14 @@ class CGIUtilTest < Test::Unit::TestCase
|
||||
assert_equal("<BR><A HREF="url"></A>", escapeElement('<BR><A HREF="url"></A>', ["A", "IMG"]))
|
||||
assert_equal("<BR><A HREF="url"></A>", escape_element('<BR><A HREF="url"></A>', "A", "IMG"))
|
||||
assert_equal("<BR><A HREF="url"></A>", escape_element('<BR><A HREF="url"></A>', ["A", "IMG"]))
|
||||
+
|
||||
+ assert_equal("<A <A HREF="url"></A>", escapeElement('<A <A HREF="url"></A>', "A", "IMG"))
|
||||
+ assert_equal("<A <A HREF="url"></A>", escapeElement('<A <A HREF="url"></A>', ["A", "IMG"]))
|
||||
+ assert_equal("<A <A HREF="url"></A>", escape_element('<A <A HREF="url"></A>', "A", "IMG"))
|
||||
+ assert_equal("<A <A HREF="url"></A>", escape_element('<A <A HREF="url"></A>', ["A", "IMG"]))
|
||||
+
|
||||
+ assert_equal("<A <A ", escapeElement('<A <A ', "A", "IMG"))
|
||||
+ assert_equal("<A <A ", escapeElement('<A <A ', ["A", "IMG"]))
|
||||
end
|
||||
|
||||
|
||||
@@ -277,6 +285,16 @@ class CGIUtilTest < Test::Unit::TestCase
|
||||
assert_equal('<BR><A HREF="url"></A>', unescapeElement(escapeHTML('<BR><A HREF="url"></A>'), ["A", "IMG"]))
|
||||
assert_equal('<BR><A HREF="url"></A>', unescape_element(escapeHTML('<BR><A HREF="url"></A>'), "A", "IMG"))
|
||||
assert_equal('<BR><A HREF="url"></A>', unescape_element(escapeHTML('<BR><A HREF="url"></A>'), ["A", "IMG"]))
|
||||
+
|
||||
+ assert_equal('<A <A HREF="url"></A>', unescapeElement(escapeHTML('<A <A HREF="url"></A>'), "A", "IMG"))
|
||||
+ assert_equal('<A <A HREF="url"></A>', unescapeElement(escapeHTML('<A <A HREF="url"></A>'), ["A", "IMG"]))
|
||||
+ assert_equal('<A <A HREF="url"></A>', unescape_element(escapeHTML('<A <A HREF="url"></A>'), "A", "IMG"))
|
||||
+ assert_equal('<A <A HREF="url"></A>', unescape_element(escapeHTML('<A <A HREF="url"></A>'), ["A", "IMG"]))
|
||||
+
|
||||
+ assert_equal('<A <A ', unescapeElement(escapeHTML('<A <A '), "A", "IMG"))
|
||||
+ assert_equal('<A <A ', unescapeElement(escapeHTML('<A <A '), ["A", "IMG"]))
|
||||
+ assert_equal('<A <A ', unescape_element(escapeHTML('<A <A '), "A", "IMG"))
|
||||
+ assert_equal('<A <A ', unescape_element(escapeHTML('<A <A '), ["A", "IMG"]))
|
||||
end
|
||||
end
|
||||
|
||||
--
|
||||
2.40.0
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
From 3675494839112b64d5f082a9068237b277ed1495 Mon Sep 17 00:00:00 2001
|
||||
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
||||
Date: Fri, 21 Feb 2025 16:29:36 +0900
|
||||
Subject: [PATCH] Truncate userinfo with URI#join, URI#merge and URI#+
|
||||
|
||||
CVE: CVE-2025-27221
|
||||
|
||||
Upstream-Status: Backport [https://github.com/ruby/uri/commit/3675494839112b64d5f082a9068237b277ed1495]
|
||||
|
||||
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
||||
---
|
||||
lib/uri/generic.rb | 6 +++++-
|
||||
test/uri/test_generic.rb | 11 +++++++++++
|
||||
2 files changed, 16 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/lib/uri/generic.rb b/lib/uri/generic.rb
|
||||
index f3540a2..ecc78c5 100644
|
||||
--- a/lib/uri/generic.rb
|
||||
+++ b/lib/uri/generic.rb
|
||||
@@ -1141,7 +1141,11 @@ module URI
|
||||
end
|
||||
|
||||
# RFC2396, Section 5.2, 7)
|
||||
- base.set_userinfo(rel.userinfo) if rel.userinfo
|
||||
+ if rel.userinfo
|
||||
+ base.set_userinfo(rel.userinfo)
|
||||
+ else
|
||||
+ base.set_userinfo(nil)
|
||||
+ end
|
||||
base.set_host(rel.host) if rel.host
|
||||
base.set_port(rel.port) if rel.port
|
||||
base.query = rel.query if rel.query
|
||||
diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb
|
||||
index e661937..17ba2b6 100644
|
||||
--- a/test/uri/test_generic.rb
|
||||
+++ b/test/uri/test_generic.rb
|
||||
@@ -164,6 +164,17 @@ class URI::TestGeneric < Test::Unit::TestCase
|
||||
# must be empty string to identify as path-abempty, not path-absolute
|
||||
assert_equal('', url.host)
|
||||
assert_equal('http:////example.com', url.to_s)
|
||||
+
|
||||
+ # sec-2957667
|
||||
+ url = URI.parse('http://user:pass@example.com').merge('//example.net')
|
||||
+ assert_equal('http://example.net', url.to_s)
|
||||
+ assert_nil(url.userinfo)
|
||||
+ url = URI.join('http://user:pass@example.com', '//example.net')
|
||||
+ assert_equal('http://example.net', url.to_s)
|
||||
+ assert_nil(url.userinfo)
|
||||
+ url = URI.parse('http://user:pass@example.com') + '//example.net'
|
||||
+ assert_equal('http://example.net', url.to_s)
|
||||
+ assert_nil(url.userinfo)
|
||||
end
|
||||
|
||||
def test_parse_scheme_with_symbols
|
||||
--
|
||||
2.40.0
|
||||
|
||||
@@ -0,0 +1,73 @@
|
||||
From 2789182478f42ccbb62197f952eb730e4f02bfc5 Mon Sep 17 00:00:00 2001
|
||||
From: Hiroshi SHIBATA <hsbt@ruby-lang.org>
|
||||
Date: Fri, 21 Feb 2025 18:16:28 +0900
|
||||
Subject: [PATCH] Fix merger of URI with authority component
|
||||
|
||||
https://hackerone.com/reports/2957667
|
||||
|
||||
Co-authored-by: Nobuyoshi Nakada <nobu@ruby-lang.org>
|
||||
|
||||
CVE: CVE-2025-27221
|
||||
|
||||
Upstream-Status: Backport [https://github.com/ruby/uri/commit/2789182478f42ccbb62197f952eb730e4f02bfc5]
|
||||
|
||||
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
||||
---
|
||||
lib/uri/generic.rb | 19 +++++++------------
|
||||
test/uri/test_generic.rb | 7 +++++++
|
||||
2 files changed, 14 insertions(+), 12 deletions(-)
|
||||
|
||||
diff --git a/lib/uri/generic.rb b/lib/uri/generic.rb
|
||||
index ecc78c5..2c0a88d 100644
|
||||
--- a/lib/uri/generic.rb
|
||||
+++ b/lib/uri/generic.rb
|
||||
@@ -1133,21 +1133,16 @@ module URI
|
||||
base.fragment=(nil)
|
||||
|
||||
# RFC2396, Section 5.2, 4)
|
||||
- if !authority
|
||||
- base.set_path(merge_path(base.path, rel.path)) if base.path && rel.path
|
||||
- else
|
||||
- # RFC2396, Section 5.2, 4)
|
||||
- base.set_path(rel.path) if rel.path
|
||||
+ if authority
|
||||
+ base.set_userinfo(rel.userinfo)
|
||||
+ base.set_host(rel.host)
|
||||
+ base.set_port(rel.port || base.default_port)
|
||||
+ base.set_path(rel.path)
|
||||
+ elsif base.path && rel.path
|
||||
+ base.set_path(merge_path(base.path, rel.path))
|
||||
end
|
||||
|
||||
# RFC2396, Section 5.2, 7)
|
||||
- if rel.userinfo
|
||||
- base.set_userinfo(rel.userinfo)
|
||||
- else
|
||||
- base.set_userinfo(nil)
|
||||
- end
|
||||
- base.set_host(rel.host) if rel.host
|
||||
- base.set_port(rel.port) if rel.port
|
||||
base.query = rel.query if rel.query
|
||||
base.fragment=(rel.fragment) if rel.fragment
|
||||
|
||||
diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb
|
||||
index 17ba2b6..1a70dd4 100644
|
||||
--- a/test/uri/test_generic.rb
|
||||
+++ b/test/uri/test_generic.rb
|
||||
@@ -267,6 +267,13 @@ class URI::TestGeneric < Test::Unit::TestCase
|
||||
assert_equal(u0, u1)
|
||||
end
|
||||
|
||||
+ def test_merge_authority
|
||||
+ u = URI.parse('http://user:pass@example.com:8080')
|
||||
+ u0 = URI.parse('http://new.example.org/path')
|
||||
+ u1 = u.merge('//new.example.org/path')
|
||||
+ assert_equal(u0, u1)
|
||||
+ end
|
||||
+
|
||||
def test_route
|
||||
url = URI.parse('http://hoge/a.html').route_to('http://hoge/b.html')
|
||||
assert_equal('b.html', url.to_s)
|
||||
--
|
||||
2.40.0
|
||||
|
||||
13
sources/poky/meta/recipes-devtools/ruby/ruby/run-ptest
Normal file
13
sources/poky/meta/recipes-devtools/ruby/ruby/run-ptest
Normal file
@@ -0,0 +1,13 @@
|
||||
#!/bin/sh
|
||||
|
||||
test_fullname=`find test -name test_*.rb`
|
||||
|
||||
for i in ${test_fullname}; do
|
||||
ruby ./test/runner.rb ${i} 2>&1 > /dev/null
|
||||
ret=$?
|
||||
if [ $ret != 0 ]; then
|
||||
echo "FAIL: ${i}"
|
||||
else
|
||||
echo "PASS: ${i}"
|
||||
fi
|
||||
done
|
||||
144
sources/poky/meta/recipes-devtools/ruby/ruby_3.3.5.bb
Normal file
144
sources/poky/meta/recipes-devtools/ruby/ruby_3.3.5.bb
Normal file
@@ -0,0 +1,144 @@
|
||||
SUMMARY = "An interpreter of object-oriented scripting language"
|
||||
DESCRIPTION = "Ruby is an interpreted scripting language for quick \
|
||||
and easy object-oriented programming. It has many features to process \
|
||||
text files and to do system management tasks (as in Perl). \
|
||||
It is simple, straight-forward, and extensible. \
|
||||
"
|
||||
HOMEPAGE = "http://www.ruby-lang.org/"
|
||||
SECTION = "devel/ruby"
|
||||
LICENSE = "Ruby | BSD-2-Clause | BSD-3-Clause | GPL-2.0-only | ISC | MIT"
|
||||
LIC_FILES_CHKSUM = "file://COPYING;md5=5b8c87559868796979806100db3f3805 \
|
||||
file://BSDL;md5=8b50bc6de8f586dc66790ba11d064d75 \
|
||||
file://GPL;md5=b234ee4d69f5fce4486a80fdaf4a4263 \
|
||||
file://LEGAL;md5=81e6a4d81533b9263da4c3485a0ad883 \
|
||||
"
|
||||
|
||||
DEPENDS = "zlib openssl libyaml gdbm readline libffi"
|
||||
DEPENDS:append:class-target = " ruby-native"
|
||||
DEPENDS:append:class-nativesdk = " ruby-native"
|
||||
|
||||
SHRT_VER = "${@oe.utils.trim_version("${PV}", 2)}"
|
||||
SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \
|
||||
file://0001-extmk-fix-cross-compilation-of-external-gems.patch \
|
||||
file://run-ptest \
|
||||
file://0003-rdoc-build-reproducible-documentation.patch \
|
||||
file://0004-lib-mkmf.rb-sort-list-of-object-files-in-generated-M.patch \
|
||||
file://0005-Mark-Gemspec-reproducible-change-fixing-784225-too.patch \
|
||||
file://0006-Make-gemspecs-reproducible.patch \
|
||||
file://0001-vm_dump.c-Define-REG_S1-and-REG_S2-for-musl-riscv.patch \
|
||||
file://CVE-2025-27219.patch \
|
||||
file://CVE-2025-27220.patch \
|
||||
file://CVE-2025-27221-0001.patch \
|
||||
file://CVE-2025-27221-0002.patch \
|
||||
"
|
||||
UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/"
|
||||
|
||||
inherit autotools ptest pkgconfig
|
||||
|
||||
|
||||
# This snippet lets compiled extensions which rely on external libraries,
|
||||
# such as zlib, compile properly. If we don't do this, then when extmk.rb
|
||||
# runs, it uses the native libraries instead of the target libraries, and so
|
||||
# none of the linking operations succeed -- which makes extconf.rb think
|
||||
# that the libraries aren't available and hence that the extension can't be
|
||||
# built.
|
||||
|
||||
do_configure:prepend() {
|
||||
sed -i "s#%%TARGET_CFLAGS%%#$CFLAGS#; s#%%TARGET_LDFLAGS%%#$LDFLAGS#" ${S}/common.mk
|
||||
rm -rf ${S}/ruby/
|
||||
}
|
||||
|
||||
DEPENDS:append:libc-musl = " libucontext"
|
||||
|
||||
SRC_URI[sha256sum] = "3781a3504222c2f26cb4b9eb9c1a12dbf4944d366ce24a9ff8cf99ecbce75196"
|
||||
|
||||
PACKAGECONFIG ??= ""
|
||||
PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
|
||||
|
||||
PACKAGECONFIG[valgrind] = "--with-valgrind=yes, --with-valgrind=no, valgrind"
|
||||
PACKAGECONFIG[gmp] = "--with-gmp=yes, --with-gmp=no, gmp"
|
||||
PACKAGECONFIG[ipv6] = "--enable-ipv6, --disable-ipv6,"
|
||||
# rdoc is off by default due to non-reproducibility reported in
|
||||
# https://bugs.ruby-lang.org/issues/18456
|
||||
PACKAGECONFIG[rdoc] = "--enable-install-rdoc,--disable-install-rdoc,"
|
||||
|
||||
EXTRA_OECONF = "\
|
||||
--disable-versioned-paths \
|
||||
--disable-rpath \
|
||||
--disable-dtrace \
|
||||
--enable-shared \
|
||||
--enable-load-relative \
|
||||
--with-pkg-config=pkg-config \
|
||||
--with-static-linked-ext \
|
||||
--with-mantype=man \
|
||||
"
|
||||
|
||||
EXTRA_OECONF:append:libc-musl = "\
|
||||
ac_cv_func_isnan=yes \
|
||||
ac_cv_func_isinf=yes \
|
||||
"
|
||||
|
||||
PARALLEL_MAKEINST = ""
|
||||
|
||||
do_install:append:class-target () {
|
||||
# Find out rbconfig.rb from .installed.list
|
||||
rbconfig_rb=`grep rbconfig.rb ${B}/.installed.list`
|
||||
# Remove build host directories
|
||||
sed -i -e 's:--sysroot=${STAGING_DIR_TARGET}::g' \
|
||||
-e s:'--with-libtool-sysroot=${STAGING_DIR_TARGET}'::g \
|
||||
-e 's|${DEBUG_PREFIX_MAP}||g' \
|
||||
-e 's:${HOSTTOOLS_DIR}/::g' \
|
||||
-e 's:${RECIPE_SYSROOT_NATIVE}::g' \
|
||||
-e 's:${RECIPE_SYSROOT}::g' \
|
||||
-e 's:${BASE_WORKDIR}/${MULTIMACH_TARGET_SYS}::g' \
|
||||
${D}$rbconfig_rb
|
||||
|
||||
sed -i -e 's|${DEBUG_PREFIX_MAP}||g' \
|
||||
${D}${libdir}/pkgconfig/*.pc
|
||||
|
||||
# logs that may contain host-specific paths
|
||||
find ${D} -name gem_make.out -delete
|
||||
}
|
||||
|
||||
do_install_ptest () {
|
||||
cp -rf ${S}/test ${D}${PTEST_PATH}/
|
||||
|
||||
install -D ${S}/tool/test/runner.rb ${D}${PTEST_PATH}/tool/test/runner.rb
|
||||
cp -r ${S}/tool/lib ${D}${PTEST_PATH}/tool/
|
||||
mkdir -p ${D}${PTEST_PATH}/lib
|
||||
cp -r ${S}/lib/did_you_mean ${S}/lib/rdoc ${D}${PTEST_PATH}/lib
|
||||
|
||||
# install test-binaries
|
||||
# These .so files have sporadic reproducibility fails as seen here:
|
||||
# https://autobuilder.yocto.io/pub/repro-fail/oe-reproducible-20220107-rm1diuww/packages/diff-html/
|
||||
# As they are needed only in ruby-ptest, and that is currently altogether disabled, let's take them out.
|
||||
# If someone wants to look at where the non-determinism comes from, one possible reason is use of
|
||||
# -rdynamic -Wl,-export-dynamic
|
||||
#find $(find ./.ext -path '*/-test-') -name '*.so' -print0 \
|
||||
# | tar --no-recursion --null -T - --no-same-owner --preserve-permissions -cf - \
|
||||
# | tar -C ${D}${libdir}/ruby/${SHRT_VER}.0/ --no-same-owner --preserve-permissions --strip-components=2 -xf -
|
||||
# adjust path to not assume build directory layout
|
||||
sed -e 's|File.expand_path(.*\.\./bin/erb[^)]*|File.expand_path("${bindir}/erb"|g' \
|
||||
-i ${D}${PTEST_PATH}/test/erb/test_erb_command.rb
|
||||
|
||||
cp -r ${S}/include ${D}/${libdir}/ruby/
|
||||
}
|
||||
|
||||
PACKAGES =+ "${PN}-ri-docs ${PN}-rdoc"
|
||||
|
||||
SUMMARY:${PN}-ri-docs = "ri (Ruby Interactive) documentation for the Ruby standard library"
|
||||
RDEPENDS:${PN}-ri-docs = "${PN}"
|
||||
FILES:${PN}-ri-docs += "${datadir}/ri"
|
||||
|
||||
SUMMARY:${PN}-rdoc = "RDoc documentation generator from Ruby source"
|
||||
RDEPENDS:${PN}-rdoc = "${PN}"
|
||||
FILES:${PN}-rdoc += "${libdir}/ruby/*/rdoc ${bindir}/rdoc"
|
||||
|
||||
FILES:${PN} += "${datadir}/rubygems"
|
||||
|
||||
FILES:${PN}-ptest:append:class-target = "\
|
||||
${libdir}/ruby/include \
|
||||
${libdir}/ruby/${SHRT_VER}.0/*/-test- \
|
||||
"
|
||||
|
||||
BBCLASSEXTEND = "native nativesdk"
|
||||
Reference in New Issue
Block a user