From 119b2bd498f138dfaddadfb607a6156c8c3a64e9 Mon Sep 17 00:00:00 2001 From: Bohuslav Kabrda Date: Fri, 16 Mar 2012 08:16:44 +0100 Subject: The CVE patch name now contains the CVE id. --- ...vesupport-CVE-2012-1098-safe-buffer-slice.patch | 194 +++++++++++++++++++++ activesupport-safe-buffer-slice-fix.patch | 194 --------------------- rubygem-activesupport.spec | 7 +- 3 files changed, 199 insertions(+), 196 deletions(-) create mode 100644 activesupport-CVE-2012-1098-safe-buffer-slice.patch delete mode 100644 activesupport-safe-buffer-slice-fix.patch diff --git a/activesupport-CVE-2012-1098-safe-buffer-slice.patch b/activesupport-CVE-2012-1098-safe-buffer-slice.patch new file mode 100644 index 0000000..133be11 --- /dev/null +++ b/activesupport-CVE-2012-1098-safe-buffer-slice.patch @@ -0,0 +1,194 @@ +From 00e632de2bde61425142ef8edc408e8d21ff9134 Mon Sep 17 00:00:00 2001 +From: Aaron Patterson +Date: Wed, 29 Feb 2012 16:37:30 -0800 +Subject: [PATCH] Squashed commit of the following: +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +commit 917fd1a03845f4eedaccbc338f9d7524e98d45ee +Author: José Valim +Date: Wed Feb 29 22:30:51 2012 +0100 + + Ensure [] respects the status of the buffer. + +commit 6adc41789017682306181e3db5b30337fe450bcc +Author: Akira Matsuda +Date: Mon Feb 13 17:57:05 2012 +0900 + + use AS::SafeBuffer#clone_empty for flushing the output_buffer + +commit e50ee96a0b37e7c5adfc555edd402ad04cc159f1 +Author: Akira Matsuda +Date: Mon Feb 13 17:54:58 2012 +0900 + + add AS::SafeBuffer#clone_empty +--- + .../lib/action_view/helpers/capture_helper.rb | 2 +- + .../core_ext/string/output_safety.rb | 50 ++++++++++++------- + activesupport/test/safe_buffer_test.rb | 46 ++++++++++++++++-- + 3 files changed, 74 insertions(+), 24 deletions(-) + +diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb +index 266f028..c0efe37 100644 +--- a/activesupport/lib/active_support/core_ext/string/output_safety.rb ++++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb +@@ -85,23 +85,41 @@ module ActiveSupport #:nodoc: + end + end + ++ def [](*args) ++ return super if args.size < 2 ++ ++ if html_safe? ++ new_safe_buffer = super ++ new_safe_buffer.instance_eval { @html_safe = true } ++ new_safe_buffer ++ else ++ to_str[*args] ++ end ++ end ++ + def safe_concat(value) +- raise SafeConcatError if dirty? ++ raise SafeConcatError unless html_safe? + original_concat(value) + end + + def initialize(*) +- @dirty = false ++ @html_safe = true + super + end + + def initialize_copy(other) + super +- @dirty = other.dirty? ++ @html_safe = other.html_safe? ++ end ++ ++ def clone_empty ++ new_safe_buffer = self[0, 0] ++ new_safe_buffer.instance_variable_set(:@dirty, @dirty) ++ new_safe_buffer + end + + def concat(value) +- if dirty? || value.html_safe? ++ if !html_safe? || value.html_safe? + super(value) + else + super(ERB::Util.h(value)) +@@ -114,7 +132,7 @@ module ActiveSupport #:nodoc: + end + + def html_safe? +- !dirty? ++ defined?(@html_safe) && @html_safe + end + + def to_s +@@ -132,23 +150,17 @@ module ActiveSupport #:nodoc: + for unsafe_method in UNSAFE_STRING_METHODS + if 'String'.respond_to?(unsafe_method) + class_eval <<-EOT, __FILE__, __LINE__ + 1 +- def #{unsafe_method}(*args) +- super.to_str +- end +- +- def #{unsafe_method}!(*args) +- @dirty = true +- super +- end ++ def #{unsafe_method}(*args, &block) # def capitalize(*args, &block) ++ to_str.#{unsafe_method}(*args, &block) # to_str.capitalize(*args, &block) ++ end # end ++ ++ def #{unsafe_method}!(*args) # def capitalize!(*args) ++ @html_safe = false # @html_safe = false ++ super # super ++ end # end + EOT + end + end +- +- protected +- +- def dirty? +- @dirty +- end + end + end + +diff --git a/activesupport/test/safe_buffer_test.rb b/activesupport/test/safe_buffer_test.rb +index 77ea273..894be1b 100644 +--- a/activesupport/test/safe_buffer_test.rb ++++ b/activesupport/test/safe_buffer_test.rb +@@ -65,22 +65,60 @@ class SafeBufferTest < ActiveSupport::TestCase + assert_equal "hello<>", clean + @buffer + end + +- test "Should concat as a normal string when dirty" do +- dirty = @buffer ++ test "Should concat as a normal string when safe" do + clean = "hello".html_safe + @buffer.gsub!('', '<>') + assert_equal "<>hello", @buffer + clean + end + +- test "Should preserve dirty? status on copy" do ++ test "Should preserve html_safe? status on copy" do + @buffer.gsub!('', '<>') + assert !@buffer.dup.html_safe? + end + +- test "Should raise an error when safe_concat is called on dirty buffers" do ++ test "Should return safe buffer when added with another safe buffer" do ++ clean = "') ++ ++ # calling gsub! makes the dirty flag true ++ assert !x.html_safe?, "should not be safe" ++ ++ # getting a slice of it ++ y = x[0..-1] ++ ++ # should still be unsafe ++ assert !y.html_safe?, "should not be safe" ++ end + end +-- +1.7.6 + diff --git a/activesupport-safe-buffer-slice-fix.patch b/activesupport-safe-buffer-slice-fix.patch deleted file mode 100644 index 133be11..0000000 --- a/activesupport-safe-buffer-slice-fix.patch +++ /dev/null @@ -1,194 +0,0 @@ -From 00e632de2bde61425142ef8edc408e8d21ff9134 Mon Sep 17 00:00:00 2001 -From: Aaron Patterson -Date: Wed, 29 Feb 2012 16:37:30 -0800 -Subject: [PATCH] Squashed commit of the following: -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 917fd1a03845f4eedaccbc338f9d7524e98d45ee -Author: José Valim -Date: Wed Feb 29 22:30:51 2012 +0100 - - Ensure [] respects the status of the buffer. - -commit 6adc41789017682306181e3db5b30337fe450bcc -Author: Akira Matsuda -Date: Mon Feb 13 17:57:05 2012 +0900 - - use AS::SafeBuffer#clone_empty for flushing the output_buffer - -commit e50ee96a0b37e7c5adfc555edd402ad04cc159f1 -Author: Akira Matsuda -Date: Mon Feb 13 17:54:58 2012 +0900 - - add AS::SafeBuffer#clone_empty ---- - .../lib/action_view/helpers/capture_helper.rb | 2 +- - .../core_ext/string/output_safety.rb | 50 ++++++++++++------- - activesupport/test/safe_buffer_test.rb | 46 ++++++++++++++++-- - 3 files changed, 74 insertions(+), 24 deletions(-) - -diff --git a/activesupport/lib/active_support/core_ext/string/output_safety.rb b/activesupport/lib/active_support/core_ext/string/output_safety.rb -index 266f028..c0efe37 100644 ---- a/activesupport/lib/active_support/core_ext/string/output_safety.rb -+++ b/activesupport/lib/active_support/core_ext/string/output_safety.rb -@@ -85,23 +85,41 @@ module ActiveSupport #:nodoc: - end - end - -+ def [](*args) -+ return super if args.size < 2 -+ -+ if html_safe? -+ new_safe_buffer = super -+ new_safe_buffer.instance_eval { @html_safe = true } -+ new_safe_buffer -+ else -+ to_str[*args] -+ end -+ end -+ - def safe_concat(value) -- raise SafeConcatError if dirty? -+ raise SafeConcatError unless html_safe? - original_concat(value) - end - - def initialize(*) -- @dirty = false -+ @html_safe = true - super - end - - def initialize_copy(other) - super -- @dirty = other.dirty? -+ @html_safe = other.html_safe? -+ end -+ -+ def clone_empty -+ new_safe_buffer = self[0, 0] -+ new_safe_buffer.instance_variable_set(:@dirty, @dirty) -+ new_safe_buffer - end - - def concat(value) -- if dirty? || value.html_safe? -+ if !html_safe? || value.html_safe? - super(value) - else - super(ERB::Util.h(value)) -@@ -114,7 +132,7 @@ module ActiveSupport #:nodoc: - end - - def html_safe? -- !dirty? -+ defined?(@html_safe) && @html_safe - end - - def to_s -@@ -132,23 +150,17 @@ module ActiveSupport #:nodoc: - for unsafe_method in UNSAFE_STRING_METHODS - if 'String'.respond_to?(unsafe_method) - class_eval <<-EOT, __FILE__, __LINE__ + 1 -- def #{unsafe_method}(*args) -- super.to_str -- end -- -- def #{unsafe_method}!(*args) -- @dirty = true -- super -- end -+ def #{unsafe_method}(*args, &block) # def capitalize(*args, &block) -+ to_str.#{unsafe_method}(*args, &block) # to_str.capitalize(*args, &block) -+ end # end -+ -+ def #{unsafe_method}!(*args) # def capitalize!(*args) -+ @html_safe = false # @html_safe = false -+ super # super -+ end # end - EOT - end - end -- -- protected -- -- def dirty? -- @dirty -- end - end - end - -diff --git a/activesupport/test/safe_buffer_test.rb b/activesupport/test/safe_buffer_test.rb -index 77ea273..894be1b 100644 ---- a/activesupport/test/safe_buffer_test.rb -+++ b/activesupport/test/safe_buffer_test.rb -@@ -65,22 +65,60 @@ class SafeBufferTest < ActiveSupport::TestCase - assert_equal "hello<>", clean + @buffer - end - -- test "Should concat as a normal string when dirty" do -- dirty = @buffer -+ test "Should concat as a normal string when safe" do - clean = "hello".html_safe - @buffer.gsub!('', '<>') - assert_equal "<>hello", @buffer + clean - end - -- test "Should preserve dirty? status on copy" do -+ test "Should preserve html_safe? status on copy" do - @buffer.gsub!('', '<>') - assert !@buffer.dup.html_safe? - end - -- test "Should raise an error when safe_concat is called on dirty buffers" do -+ test "Should return safe buffer when added with another safe buffer" do -+ clean = "') -+ -+ # calling gsub! makes the dirty flag true -+ assert !x.html_safe?, "should not be safe" -+ -+ # getting a slice of it -+ y = x[0..-1] -+ -+ # should still be unsafe -+ assert !y.html_safe?, "should not be safe" -+ end - end --- -1.7.6 - diff --git a/rubygem-activesupport.spec b/rubygem-activesupport.spec index 974e7ce..2a57f67 100644 --- a/rubygem-activesupport.spec +++ b/rubygem-activesupport.spec @@ -7,7 +7,7 @@ Summary: Support and utility classes used by the Rails framework Name: rubygem-%{gem_name} Epoch: 1 Version: 3.0.11 -Release: 3%{?dist} +Release: 4%{?dist} Group: Development/Languages License: MIT URL: http://www.rubyonrails.org @@ -32,7 +32,7 @@ Patch2: activesupport-remove-memcache-build-dep.patch # Fixes CVE-2012-1098 # https://bugzilla.redhat.com/show_bug.cgi?id=799275 -Patch3: activesupport-safe-buffer-slice-fix.patch +Patch3: activesupport-CVE-2012-1098-safe-buffer-slice.patch BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n) Requires: ruby(rubygems) @@ -96,6 +96,9 @@ popd %changelog +* Fri Mar 16 2012 Bohuslav Kabrda - 1:3.0.11-4 +- The CVE patch name now contains the CVE id. + * Mon Mar 05 2012 Bohuslav Kabrda - 1:3.0.11-3 - Patch for CVE-2012-1098 -- cgit