[gentoo-commits] repo/gentoo:master commit in: dev-java/dom4j/files/, dev-java/dom4j/

[Miroslav Šulc]

commit:     fdefd7b25414d9e57612fb8b43c28e7e6e65ce4d
Author:     Volkmar W. Pogatzki <gentoo <AT> pogatzki <DOT> net>
AuthorDate: Mon May 17 13:24:31 2021 +0000
Commit:     Miroslav Šulc <fordfrog <AT> gentoo <DOT> org>
CommitDate: Sat Jul 17 12:09:03 2021 +0000
URL:        https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=fdefd7b2

dev-java/dom4j: bump to 2.1.3 (CVE-2020-10683)

Bug: https://bugs.gentoo.org/719318
rewritten with java-pkg-simple.eclass
introducing "jaxen" USE flag

Package-Manager: Portage-3.0.18, Repoman-3.0.2
Signed-off-by: Volkmar W. Pogatzki <gentoo <AT> pogatzki.net>
Closes: https://github.com/gentoo/gentoo/pull/21319
Signed-off-by: Miroslav Šulc <fordfrog <AT> gentoo.org>

 dev-java/dom4j/Manifest                            |  2 +
 dev-java/dom4j/dom4j-2.1.3.ebuild                  | 75 ++++++++++++++++++++++
 .../dom4j-2.1.3-xpp3-add-removeAttribute.patch     | 47 ++++++++++++++
 dev-java/dom4j/metadata.xml                        |  3 +
 4 files changed, 127 insertions(+)

diff --git a/dev-java/dom4j/Manifest b/dev-java/dom4j/Manifest
index a5c57e59200..8913db1a98e 100644
--- a/dev-java/dom4j/Manifest
+++ b/dev-java/dom4j/Manifest
@@ -1,2 +1,4 @@
 DIST dom4j-1.6.1-java5.patch.bz2 2900 BLAKE2B cdd7dc901f5292af3ef7f0ea200c3d22bbc8c0adc27606da3c8fbadc44625b114c995321723dca331f0b23d5248e1f9177f0def2f4138eebcbd4aaac0495d4dd SHA512 38da606d77b62976366cd089e5194a922e348ec396e7b9af4dceb0a536c47f66e0900cfa59c91df04aade6076630077a8f88c713b9c20224d69316109b293a96
 DIST dom4j-1.6.1.tar.gz 9687211 BLAKE2B 3daa3729ea071aa87c7c1e1e2b91f1635109774dd2bd564a85265a0286f1369373084b945409d9d5213d66a7e14224033d42c58d80125b7982eef8961eb29248 SHA512 95c5a7105a81734f77b4bf27f8bb0af116bf43d8ad5297a0902a6687a54109a87dffe2953cf430d14947cdaa590aa0fdf083b46a91d1d98d48431cfae4459d94
+DIST dom4j-2.1.3.tar.gz 565918 BLAKE2B d6f8c9ae22f84086491ca7e60e5498edda727b219b4fe019da8f62a441dc3cea86ecf0554e32f8e717e21234b8ef8e2905946ab3722462f1fa748ad7e68e9e20 SHA512 8c4d7b4f2dd1b3f806e0d5103101998a094c31e9a4912539dcee32f24b35452c7f0d72c5f4cf55f8a8c9a416fee7284f9bca43ae56b0e66104b2b54fdb49ad96
+DIST jaxen-1.2.0.jar 232455 BLAKE2B 6bd16e8ac34f3af1b9d61218dc6a29862178516cfbb98c6834bf6db846b537e44b48db6ff578b3d67d32c3e2b142e44440a2fdcc6dc06a6ea427b04e6bf1f370 SHA512 cad582fc12d0741e9e6fd7e0cf80a50feb04f5ef42043df96f8a5b78476c77695d8b43836d2241f76b35676ea759921edd25eaeb2c04ec916eb138aa2901ce5f

diff --git a/dev-java/dom4j/dom4j-2.1.3.ebuild b/dev-java/dom4j/dom4j-2.1.3.ebuild
new file mode 100644
index 00000000000..46f4b495689
--- /dev/null
+++ b/dev-java/dom4j/dom4j-2.1.3.ebuild
@@ -0,0 +1,75 @@
+# Copyright 1999-2021 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+# Skeleton command:
+# java-ebuilder --generate-ebuild --workdir . --pom dom4j-2.1.3.pom --download-uri https://github.com/dom4j/dom4j/archive/refs/tags/version-2.1.3.tar.gz --slot 1 --keywords "~amd64 ~arm ~arm64 ~ppc64 ~x86" --ebuild dom4j-2.1.3.ebuild
+
+EAPI=7
+
+JAVA_PKG_IUSE="doc source test"
+MAVEN_ID="org.dom4j:dom4j:2.1.3"
+JAVA_TESTING_FRAMEWORKS="testng"
+
+inherit java-pkg-2 java-pkg-simple
+
+DESCRIPTION="flexible XML framework for Java"
+HOMEPAGE="https://dom4j.github.io/"
+SRC_URI="https://github.com/${PN}/${PN}/archive/refs/tags/version-${PV}.tar.gz -> ${P}.tar.gz
+	https://repo1.maven.org/maven2/jaxen/jaxen/1.2.0/jaxen-1.2.0.jar"
+
+LICENSE="dom4j"
+SLOT="1"
+KEYWORDS="~amd64 ~x86"
+IUSE="jaxen"
+
+CDEPEND="
+	dev-java/jaxb-api:2
+	dev-java/xpp2:0
+	dev-java/xpp3:0
+	dev-java/xsdlib:0
+	jaxen? ( dev-java/jaxen:1.2[dom4j] )
+"
+DEPEND="${CDEPEND}
+	>=virtual/jdk-1.8:*
+	test? ( dev-java/xerces:2 )
+"
+
+# Runtime dependencies
+# POM: ${P}.pom
+# javax.xml.bind:jaxb-api:2.2.12 -> !!!groupId-not-found!!!
+# javax.xml.stream:stax-api:1.0-2 -> java-virtuals/stax-api:0
+# jaxen:jaxen:1.1.6 -> >=dev-java/jaxen-1.2.0:1.2
+# net.java.dev.msv:xsdlib:2013.6.1 -> >=dev-java/xsdlib-20090415:0
+# pull-parser:pull-parser:2 -> >=dev-java/xpp2-2.1.10:0
+# xpp3:xpp3:1.1.4c -> >=dev-java/xpp3-1.1.4c:0
+
+RDEPEND="${CDEPEND}
+	>=virtual/jre-1.8:*
+"
+
+PATCHES=(
+	# XmlStartTag.java:31: error: ProxyXmlStartTag is not abstract and does not override abstract method removeAttributeByRawName
+	# patch from https://github.com/dom4j/dom4j/pull/22
+	"${FILESDIR}"/dom4j-2.1.3-xpp3-add-removeAttribute.patch
+)
+
+S="${WORKDIR}/${PN}-version-${PV}"
+
+# dom4j has a cyclic dependency on jaxen[dom4j].
+# The downloaded jaxen-1.2.0.jar is provided for compilation only.
+# No prebuilt software is actually installed onto the system.
+JAVA_GENTOO_CLASSPATH_EXTRA="${DISTDIR}/jaxen-1.2.0.jar"
+JAVA_GENTOO_CLASSPATH="jaxb-api-2,xpp2,xpp3,xsdlib"
+JAVA_SRC_DIR="src/main/java"
+
+JAVA_TEST_GENTOO_CLASSPATH="testng,xerces-2"
+JAVA_TEST_SRC_DIR="src/test/java"
+JAVA_TEST_RESOURCE_DIRS="xml"
+
+src_prepare() {
+	default
+
+	if use jaxen; then
+		JAVA_GENTOO_CLASSPATH+=" jaxen-1.2"
+	fi
+}

diff --git a/dev-java/dom4j/files/dom4j-2.1.3-xpp3-add-removeAttribute.patch b/dev-java/dom4j/files/dom4j-2.1.3-xpp3-add-removeAttribute.patch
new file mode 100644
index 00000000000..a58a06dfcd6
--- /dev/null
+++ b/dev-java/dom4j/files/dom4j-2.1.3-xpp3-add-removeAttribute.patch
@@ -0,0 +1,47 @@
+diff --git a/src/main/java/org/dom4j/xpp/ProxyXmlStartTag.java b/src/main/java/org/dom4j/xpp/ProxyXmlStartTag.java
+index 08b88fc..aa27c10 100644
+--- a/src/main/java/org/dom4j/xpp/ProxyXmlStartTag.java
++++ b/src/main/java/org/dom4j/xpp/ProxyXmlStartTag.java
+@@ -211,7 +211,7 @@ public class ProxyXmlStartTag implements XmlStartTag {
+      * @throws XmlPullParserException
+      *             DOCUMENT ME!
+      */
+-    public void removeAtttributes() throws XmlPullParserException {
++    public void removeAttributes() throws XmlPullParserException {
+         if (element != null) {
+             element.setAttributes(new ArrayList());
+ 
+@@ -221,6 +221,33 @@ public class ProxyXmlStartTag implements XmlStartTag {
+         }
+     }
+ 
++    public boolean removeAttributeByName(String namespaceURI, String localName) throws XmlPullParserException {
++        if (element != null) {
++            for (Iterator<Attribute> iter = element.attributeIterator(); iter.hasNext();) {
++                Attribute attribute = iter.next();
++
++                if (namespaceURI.equals(attribute.getNamespaceURI())
++                        && localName.equals(attribute.getName())) {
++                    return element.remove(attribute);
++                }
++            }
++        }
++        return false;
++    }
++
++    public boolean removeAttributeByRawName(String rawName) throws XmlPullParserException {
++        if (element != null) {
++            for (Iterator<Attribute> iter = element.attributeIterator(); iter.hasNext();) {
++                Attribute attribute = iter.next();
++
++                if (rawName.equals(attribute.getQualifiedName())) {
++                    return element.remove(attribute);
++                }
++            }
++        }
++        return false;
++    }
++
+     public String getLocalName() {
+         return element.getName();
+     }

diff --git a/dev-java/dom4j/metadata.xml b/dev-java/dom4j/metadata.xml
index 2d873897cf3..cdff47537f0 100644
--- a/dev-java/dom4j/metadata.xml
+++ b/dev-java/dom4j/metadata.xml
@@ -5,6 +5,9 @@
 		<email>java@g.o</email>
 		<name>Java</name>
 	</maintainer>
+	<use>
+		<flag name="jaxen">Includes org.jaxen.dom4j package</flag>
+	</use>
 	<longdescription>
 		Easy to use, open source library for working with XML, XPath and
 		XSLT on the Java platform using the Java Collections Framework