1 |
commit: 6ab4da0dccbc2a77285e0c200d2ee3df58249ec6 |
2 |
Author: Andreas K. Hüttel <dilfridge <AT> gentoo <DOT> org> |
3 |
AuthorDate: Fri Dec 30 16:40:18 2016 +0000 |
4 |
Commit: Andreas Hüttel <dilfridge <AT> gentoo <DOT> org> |
5 |
CommitDate: Fri Dec 30 16:40:53 2016 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6ab4da0d |
7 |
|
8 |
dev-perl/XML-LibXML: Disable expanding external entities by default, bug 594614 |
9 |
|
10 |
Patch by ppisar <AT> redhat.com |
11 |
https://rt.cpan.org/Public/Bug/Display.html?id=118032 |
12 |
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838097 |
13 |
https://bugzilla.redhat.com/show_bug.cgi?id=1377996 |
14 |
|
15 |
Package-Manager: Portage-2.3.3, Repoman-2.3.1 |
16 |
|
17 |
dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild | 70 +++++++++++++++++++++ |
18 |
.../XML-LibXML-2.12.800-disable-expanding.patch | 72 ++++++++++++++++++++++ |
19 |
2 files changed, 142 insertions(+) |
20 |
|
21 |
diff --git a/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild b/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild |
22 |
new file mode 100644 |
23 |
index 00000000..75c4674 |
24 |
--- /dev/null |
25 |
+++ b/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild |
26 |
@@ -0,0 +1,70 @@ |
27 |
+# Copyright 1999-2016 Gentoo Foundation |
28 |
+# Distributed under the terms of the GNU General Public License v2 |
29 |
+# $Id$ |
30 |
+ |
31 |
+EAPI=6 |
32 |
+ |
33 |
+DIST_AUTHOR=SHLOMIF |
34 |
+DIST_VERSION=2.0128 |
35 |
+DIST_EXAMPLES=("example/*") |
36 |
+inherit perl-module |
37 |
+ |
38 |
+DESCRIPTION="Perl binding for libxml2" |
39 |
+ |
40 |
+SLOT="0" |
41 |
+KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris" |
42 |
+IUSE="test minimal" |
43 |
+ |
44 |
+RDEPEND=" |
45 |
+ >=dev-perl/XML-SAX-0.120.0 |
46 |
+ >=dev-libs/libxml2-2.6.21 |
47 |
+ dev-perl/XML-SAX-Base |
48 |
+ >=dev-perl/XML-NamespaceSupport-1.70.0 |
49 |
+" |
50 |
+DEPEND="${RDEPEND} |
51 |
+ virtual/perl-ExtUtils-MakeMaker |
52 |
+ test? ( |
53 |
+ !minimal? ( |
54 |
+ dev-perl/Test-LeakTrace |
55 |
+ ) |
56 |
+ ) |
57 |
+" |
58 |
+ |
59 |
+PATCHES=( |
60 |
+ "${FILESDIR}/${P}-disable-expanding.patch" |
61 |
+) |
62 |
+ |
63 |
+src_compile() { |
64 |
+ export SKIP_SAX_INSTALL=1 |
65 |
+ perl-module_src_compile |
66 |
+} |
67 |
+ |
68 |
+src_test() { |
69 |
+ perl_rm_files t/pod.t t/style-trailing-space.t t/cpan-changes.t |
70 |
+ perl-module_src_test |
71 |
+} |
72 |
+ |
73 |
+pkg_postinst() { |
74 |
+ pkg_update_parser add XML::LibXML::SAX::Parser |
75 |
+ pkg_update_parser add XML::LibXML::SAX |
76 |
+} |
77 |
+ |
78 |
+pkg_postrm() { |
79 |
+ pkg_update_parser remove XML::LibXML::SAX::Parser |
80 |
+ pkg_update_parser remove XML::LibXML::SAX |
81 |
+} |
82 |
+ |
83 |
+pkg_update_parser() { |
84 |
+ # pkg_update_parser [add|remove] $parser_module |
85 |
+ local action=$1 |
86 |
+ local parser_module=$2 |
87 |
+ |
88 |
+ if [[ "$ROOT" = "/" ]] ; then |
89 |
+ einfo "Update Parser: $1 $2" |
90 |
+ perl -MXML::SAX -e "XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()" \ |
91 |
+ || ewarn "Update Parser: $1 $2 failed" |
92 |
+ else |
93 |
+ elog "To $1 $2 run:" |
94 |
+ elog "perl -MXML::SAX -e 'XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()'" |
95 |
+ fi |
96 |
+} |
97 |
|
98 |
diff --git a/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch |
99 |
new file mode 100644 |
100 |
index 00000000..8be7783 |
101 |
--- /dev/null |
102 |
+++ b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch |
103 |
@@ -0,0 +1,72 @@ |
104 |
+From 05749ae525317d05bd9d4232c080e530854f1d88 Mon Sep 17 00:00:00 2001 |
105 |
+From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@××××××.com> |
106 |
+Date: Fri, 30 Sep 2016 14:31:26 +0200 |
107 |
+Subject: [PATCH] Do not enable expanding entities by default |
108 |
+MIME-Version: 1.0 |
109 |
+Content-Type: text/plain; charset=UTF-8 |
110 |
+Content-Transfer-Encoding: 8bit |
111 |
+ |
112 |
+Expanding external entity is insecure. |
113 |
+<https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing>. |
114 |
+This patch makes expand_entities option disabled by default. |
115 |
+ |
116 |
+CPAN RT#118032 |
117 |
+ |
118 |
+Signed-off-by: Petr Písař <ppisar@××××××.com> |
119 |
+--- |
120 |
+ LibXML.pm | 2 +- |
121 |
+ docs/libxml.dbk | 2 +- |
122 |
+ t/43options.t | 4 ++-- |
123 |
+ 3 files changed, 4 insertions(+), 4 deletions(-) |
124 |
+ |
125 |
+diff --git a/LibXML.pm b/LibXML.pm |
126 |
+index eb3cbd6..9ab4748 100644 |
127 |
+--- a/LibXML.pm |
128 |
++++ b/LibXML.pm |
129 |
+@@ -261,7 +261,7 @@ use constant { |
130 |
+ HTML_PARSE_NOERROR => (1<<5), # suppress error reports |
131 |
+ }; |
132 |
+ |
133 |
+-$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD | XML_PARSE_NOENT ); |
134 |
++$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD ); |
135 |
+ |
136 |
+ # this hash is made global so that applications can add names for new |
137 |
+ # libxml2 parser flags as temporary workaround |
138 |
+diff --git a/docs/libxml.dbk b/docs/libxml.dbk |
139 |
+index 30f279b..2c6674b 100644 |
140 |
+--- a/docs/libxml.dbk |
141 |
++++ b/docs/libxml.dbk |
142 |
+@@ -1676,7 +1676,7 @@ local $XML::LibXML::setTagCompression = 1;</programlisting> |
143 |
+ <term>expand_entities</term> |
144 |
+ <listitem> |
145 |
+ <para>/parser, reader/</para> |
146 |
+- <para>substitute entities; possible values are 0 and 1; default is 1</para> |
147 |
++ <para>substitute entities; possible values are 0 and 1; default is 0</para> |
148 |
+ <para>Note that although this flag disables entity substitution, it |
149 |
+ does not prevent the parser from loading external entities; |
150 |
+ when substitution of an external entity is disabled, the |
151 |
+diff --git a/t/43options.t b/t/43options.t |
152 |
+index 826f0ad..53dd35e 100644 |
153 |
+--- a/t/43options.t |
154 |
++++ b/t/43options.t |
155 |
+@@ -50,7 +50,7 @@ no_network |
156 |
+ { |
157 |
+ my $p = XML::LibXML->new(); |
158 |
+ for my $opt (@all) { |
159 |
+- my $ret = (($opt =~ /^(?:load_ext_dtd|expand_entities)$/) ? 1 : 0); |
160 |
++ my $ret = (($opt =~ /^(?:load_ext_dtd)$/) ? 1 : 0); |
161 |
+ # TEST*$all |
162 |
+ ok( |
163 |
+ ($p->get_option($opt)||0) == $ret |
164 |
+@@ -110,7 +110,7 @@ no_network |
165 |
+ ok( $p->get_option('recover') == 2, ' TODO : Add test name' ); |
166 |
+ |
167 |
+ # TEST |
168 |
+- ok( $p->expand_entities() == 1, ' TODO : Add test name' ); |
169 |
++ ok( $p->expand_entities() == 0, ' TODO : Add test name' ); |
170 |
+ # TEST |
171 |
+ ok( $p->load_ext_dtd() == 1, ' TODO : Add test name' ); |
172 |
+ $p->load_ext_dtd(0); |
173 |
+-- |
174 |
+2.7.4 |
175 |
+ |