Version 2.10.1 (CVE-2024-29131, CVE-2024-29133)

2024-03-21 09:37:37 -06:00
8 changed files with 9842 additions and 1 deletions
--- a/.gitignore
+++ b/.gitignore
@ -0,0 +1,2 @@
+/commons-configuration2-*-src.tar.gz
+/commons-configuration2-*-src.tar.gz.asc
--- a/9451
+++ b/9451
--- a/README.md
+++ b/README.md
@ -0,0 +1,29 @@
+# apache-commons-configuration
+
+The
+[Commons Configuration](https://commons.apache.org/proper/commons-configuration/)
+software library provides a generic configuration interface which enables a
+Java application to read configuration data from a variety of sources.
+Commons Configuration provides typed access to single, and multi-valued
+configuration parameters as demonstrated by the following code:
+
+> Double double = config.getDouble("number");
+> Integer integer = config.getInteger("number");
+
+Configuration parameters may be loaded from the following sources:
+- Properties files
+- XML documents
+- Windows INI files
+- Property list files (plist)
+- JNDI
+- JDBC Datasource
+- System properties
+- Applet parameters
+- Servlet parameters
+
+Configuration objects are created using configuration builders.  Different
+configuration sources can be mixed using a `CombinedConfigurationBuilder` and
+a `CombinedConfiguration`.  Additional sources of configuration parameters can
+be created by using custom configuration objects.  This customization can be
+achieved by extending `AbstractConfiguration` or
+`AbstractHierarchicalConfiguration`.
--- a/apache-commons-configuration-jexl3.patch
+++ b/apache-commons-configuration-jexl3.patch
@ -0,0 +1,59 @@
+--- commons-configuration2-2.10.1-src/pom.xml.orig	2024-03-17 14:14:52.000000000 -0600
+++ commons-configuration2-2.10.1-src/pom.xml	2024-03-21 08:56:35.553773318 -0600
+@@ -53,7 +53,7 @@
+       org.apache.commons.jxpath.*;resolution:=optional,
+       org.apache.xml.resolver.*;resolution:=optional,
+       javax.servlet.*;resolution:=optional,
+-      org.apache.commons.jexl2.*;resolution:=optional,
+      org.apache.commons.jexl3.*;resolution:=optional,
+       org.apache.commons.vfs2.*;resolution:=optional,
+       org.springframework.*;resolution:=optional,
+       com.fasterxml.jackson.*;resolution:=optional,
+@@ -142,8 +142,8 @@
+ 
+     <dependency>
+       <groupId>org.apache.commons</groupId>
+-      <artifactId>commons-jexl</artifactId>
+-      <version>2.1.1</version>
+      <artifactId>commons-jexl3</artifactId>
+      <version>3.3</version>
+       <optional>true</optional>
+     </dependency>
+ 
+--- commons-configuration2-2.10.1-src/src/main/java/org/apache/commons/configuration2/interpol/ExprLookup.java.orig	2024-03-17 14:14:52.000000000 -0600
+++ commons-configuration2-2.10.1-src/src/main/java/org/apache/commons/configuration2/interpol/ExprLookup.java	2024-03-21 08:56:12.293110406 -0600
+@@ -21,10 +21,12 @@ import java.util.Objects;
+ 
+ import org.apache.commons.configuration2.ex.ConfigurationRuntimeException;
+ import org.apache.commons.configuration2.io.ConfigurationLogger;
+-import org.apache.commons.jexl2.Expression;
+-import org.apache.commons.jexl2.JexlContext;
+-import org.apache.commons.jexl2.JexlEngine;
+-import org.apache.commons.jexl2.MapContext;
+import org.apache.commons.jexl3.JexlBuilder;
+import org.apache.commons.jexl3.JexlContext;
+import org.apache.commons.jexl3.JexlEngine;
+import org.apache.commons.jexl3.JexlExpression;
+import org.apache.commons.jexl3.MapContext;
+import org.apache.commons.jexl3.introspection.JexlPermissions;
+ import org.apache.commons.lang3.ClassUtils;
+ import org.apache.commons.lang3.StringUtils;
+ import org.apache.commons.text.StringSubstitutor;
+@@ -82,7 +84,7 @@ public class ExprLookup implements Looku
+     private ConfigurationLogger logger;
+ 
+     /** The engine. */
+-    private final JexlEngine engine = new JexlEngine();
+    private final JexlEngine engine = new JexlBuilder().permissions(JexlPermissions.UNRESTRICTED).create();
+ 
+     /** The variables maintained by this object. */
+     private Variables variables;
+@@ -215,7 +217,7 @@ public class ExprLookup implements Looku
+ 
+         String result = substitutor.replace(var);
+         try {
+-            final Expression exp = engine.createExpression(result);
+            final JexlExpression exp = engine.createExpression(result);
+             final Object exprResult = exp.evaluate(createContext());
+             result = exprResult != null ? String.valueOf(exprResult) : null;
+         } catch (final Exception e) {
--- a/apache-commons-configuration.spec
+++ b/apache-commons-configuration.spec
@ -0,0 +1,133 @@
+# Some of the test dependencies are not available in Fedora
+%bcond_with test
+
+Name:           apache-commons-configuration
+Version:        2.10.1
+Release:        %autorelease
+Summary:        Read configuration data from a variety of sources
+
+License:        Apache-2.0
+BuildArch:      noarch
+ExclusiveArch:  %{java_arches} noarch
+URL:            https://commons.apache.org/proper/commons-configuration/
+VCS:            https://github.com/apache/commons-configuration
+Source0:        https://archive.apache.org/dist/commons/configuration/source/commons-configuration2-%{version}-src.tar.gz
+Source1:        https://archive.apache.org/dist/commons/configuration/source/commons-configuration2-%{version}-src.tar.gz.asc
+Source2:        https://downloads.apache.org/commons/KEYS
+
+# Adapt to JEXL 3
+Patch0:         %{name}-jexl3.patch
+
+BuildRequires:  gnupg2
+BuildRequires:  maven-local
+BuildRequires:  mvn(commons-logging:commons-logging)
+BuildRequires:  mvn(javax.servlet:servlet-api)
+BuildRequires:  mvn(org.apache.commons:commons-lang3)
+BuildRequires:  mvn(org.apache.commons:commons-parent:pom:)
+BuildRequires:  mvn(org.apache.commons:commons-text)
+BuildRequires:  mvn(org.apache.maven.plugins:maven-assembly-plugin)
+BuildRequires:  mvn(org.apache.maven.plugins:maven-jar-plugin)
+BuildRequires:  mvn(org.apache.maven.plugins:maven-surefire-plugin)
+BuildRequires:  mvn(org.codehaus.mojo:javacc-maven-plugin)
+
+# Optional dependencies
+BuildRequires:  mvn(com.fasterxml.jackson.core:jackson-databind)
+BuildRequires:  mvn(commons-beanutils:commons-beanutils)
+BuildRequires:  mvn(commons-codec:commons-codec)
+BuildRequires:  mvn(commons-jxpath:commons-jxpath)
+BuildRequires:  mvn(org.apache.commons:commons-jexl3)
+BuildRequires:  mvn(org.apache.commons:commons-vfs2)
+BuildRequires:  mvn(org.apache.logging.log4j:log4j-core)
+BuildRequires:  mvn(org.yaml:snakeyaml)
+BuildRequires:  mvn(xml-resolver:xml-resolver)
+
+# Optional dependencies not available in Fedora
+#BuildRequires:  mvn(org.springframework:spring-beans)
+#BuildRequires:  mvn(org.springframework:spring-core)
+
+# Test dependencies
+%if %{with test}
+BuildRequires:  mvn(com.sun.mail:mailapi)
+BuildRequires:  mvn(commons-io:commons-io)
+BuildRequires:  mvn(org.apache.commons:commons-dbcp2)
+BuildRequires:  mvn(org.apache.commons:commons-pool2)
+BuildRequires:  mvn(org.dbunit:dbunit)
+BuildRequires:  mvn(org.hamcrest:hamcrest)
+BuildRequires:  mvn(org.hsqldb:hsqldb)
+BuildRequires:  mvn(org.junit.jupiter:junit-jupiter)
+BuildRequires:  mvn(org.mockito:mockito-core)
+BuildRequires:  mvn(org.slf4j:slf4j-api)
+BuildRequires:  mvn(org.slf4j:slf4j-ext)
+BuildRequires:  mvn(org.slf4j:slf4j-log4j12)
+BuildRequires:  mvn(org.slf4j:slf4j-nop)
+BuildRequires:  mvn(org.springframework:spring-context)
+BuildRequires:  mvn(org.springframework:spring-test)
+%endif
+
+%description
+The Commons Configuration software library provides a generic
+configuration interface which enables a Java application to read
+configuration data from a variety of sources.  Commons Configuration
+provides typed access to single, and multi-valued configuration
+parameters as demonstrated by the following code:
+
+Double double = config.getDouble("number");
+Integer integer = config.getInteger("number");
+
+Configuration parameters may be loaded from the following sources:
+- Properties files
+- XML documents
+- Windows INI files
+- Property list files (plist)
+- JNDI
+- JDBC Datasource
+- System properties
+- Applet parameters
+- Servlet parameters
+
+Configuration objects are created using configuration builders.
+Different configuration sources can be mixed using a
+CombinedConfigurationBuilder and a CombinedConfiguration.  Additional
+sources of configuration parameters can be created by using custom
+configuration objects.  This customization can be achieved by extending
+AbstractConfiguration or AbstractHierarchicalConfiguration.
+
+%javadoc_package
+
+%prep
+%{gpgverify} --data=%{SOURCE0} --signature=%{SOURCE1} --keyring=%{SOURCE2}
+%autosetup -n commons-configuration2-%{version}-src -p1
+
+# Not needed for RPM builds
+%pom_xpath_remove //pom:reporting
+%pom_remove_plugin :apache-rat-plugin
+%pom_remove_plugin :maven-checkstyle-plugin
+%pom_remove_plugin :maven-javadoc-plugin
+%pom_remove_plugin :maven-pmd-plugin
+%pom_remove_plugin :maven-scm-publish-plugin
+%pom_remove_plugin :spotbugs-maven-plugin
+
+# The Spring framework is not available in Fedora
+%pom_remove_dep org.springframework:spring-core
+%pom_remove_dep org.springframework:spring-beans
+%pom_remove_dep org.springframework:spring-context
+%pom_remove_dep org.springframework:spring-test
+rm -fr src/{main,test}/java/org/apache/commons/configuration2/spring
+
+%build
+# We skip tests because we don't have test deps (dbunit in particular).
+%if %{with test}
+%mvn_build -- -Dcommons.packageId=configuration
+%else
+%mvn_build -f -- -Dcommons.packageId=configuration
+%endif
+
+%install
+%mvn_install
+
+%files -f .mfiles
+%doc README.md RELEASE-NOTES.txt
+%license LICENSE.txt NOTICE.txt
+
+%changelog
+%autochangelog
--- a/166
+++ b/166
@ -0,0 +1,166 @@
+* Wed Jul 19 2023 Tomas Hrcka <thrcka@redhat.com> - 1.10-19
+- Unretirement request: https://pagure.io/releng/issue/11550
+
+* Sat Aug 01 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-18
+- Second attempt - Rebuilt for
+  https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Mon Jul 27 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-17
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
+
+* Fri Jul 10 2020 Jiri Vanek <jvanek@redhat.com> - 1.10-16
+- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11
+
+* Tue Jan 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-15
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
+
+* Wed Jul 24 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-14
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
+
+* Thu Jan 31 2019 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-13
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild
+
+* Thu Jul 12 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-12
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
+
+* Wed Feb 07 2018 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-11
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
+
+* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-10
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
+
+* Fri Feb 17 2017 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10-9
+- Temporarly disable javadoc generation
+
+* Fri Feb 10 2017 Michael Simacek <msimacek@redhat.com> - 1.10-8
+- Use log4j12
+
+* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-7
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
+
+* Wed Feb 03 2016 Fedora Release Engineering <releng@fedoraproject.org> - 1.10-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
+
+* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.10-5
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
+
+* Tue Oct 14 2014 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10-4
+- Remove legacy Obsoletes/Provides for jakarta-commons
+
+* Thu Jun 12 2014 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10-3
+- Fix BR on commons-parent
+
+* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.10-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
+
+* Tue Oct 29 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.10-1
+- Update to upstream version 1.10
+
+* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.9-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
+
+* Mon Apr 29 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.9-5
+- Remove unneeded BR: maven-idea-plugin
+
+* Wed Feb 13 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.9-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
+
+* Wed Feb 06 2013 Java SIG <java-devel@lists.fedoraproject.org> - 1.9-3
+- Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
+- Replace maven BuildRequires with maven-local
+
+* Tue Jan 15 2013 Michal Srb <msrb@redhat.com> - 1.9-2
+- Build with xmvn
+
+* Thu Aug 23 2012 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.9-1
+- Update to upstream version 1.9
+- Update to currennt packaging guidelines
+
+* Wed Jul 18 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.8-2
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild
+
+* Tue Jun 19 2012 Mikolaj Izdebski <mizdebsk@redhat.com> - 1.8-1
+- Update to upstream 1.8
+- Install NOTICE.txt file
+
+* Wed Apr 18 2012 Alexander Kurtakov <akurtako@redhat.com> 1.6-7
+- Update to current guidelines.
+- Move to servlet 3.
+
+* Thu Jan 12 2012 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6-6
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild
+
+* Tue Feb 15 2011 Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.6-5
+- Change ant dep groupId to org.apache.ant to fix build
+- Versionless jar & javadocs
+- Use maven 3 to build
+
+* Mon Feb 07 2011 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 1.6-4
+- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild
+
+* Thu Oct 14 2010 Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.6-3
+- tomcat5 -> tomcat6 BRs/Rs
+- jakarta -> apache BRs/Rs
+
+* Thu Jul  8 2010 Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.6-2
+- Add license to javadoc subpackage
+
+* Thu May 27 2010 Stanislav Ochotnicky <sochotnicky@redhat.com> - 1.6-1
+- Rename package (jakarta-commons-configuration->apache-commons-configuration)
+- Build with maven instead of ant, drop deprecated patches
+- Rebase, cleanups, drop epoch
+
+* Thu Aug 20 2009 Alexander Kurtakov <akurtako@redhat.com> 0:1.4-7
+- Fix description.
+- Remove requires(post/postun) for javadoc subpackage.
+- Use sed instead of dos2unix.
+
+* Thu Aug 20 2009 Alexander Kurtakov <akurtako@redhat.com> 0:1.4-6
+- Remove gcj support.
+- Initial build for Fedora.
+
+* Mon May 18 2009 Fernando Nasser <fnasser@redhat.com> - 0:1.4-5
+- Fix license
+- Fix source URL
+
+* Wed Mar 18 2009 Yong Yang <yyang@redhat.com> - 0:1.4-4
+- rebuild with new maven2 2.0.8 built in bootstrap mode
+
+* Thu Feb 05 2009 Yong Yang <yyang@redhat.com> - 0:1.4-3
+- Fix release tag
+
+* Wed Jan 14 2009 Yong Yang <yyang@redhat.com> - 0:1.4-2jpp
+- Import from dbhole's maven 2.0.8 packages, initial building
+
+* Mon Aug 13 2007 Ralph Apel <r.apel at r-apel.de> - 0:1.4-1jpp
+- Upgrade to 1.4
+- Add pom file
+
+* Thu May 03 2007 Ralph Apel <r.apel at r-apel.de> - 0:1.2-3jpp
+- Patch one test
+
+* Wed Mar 07 2007 Ralph Apel <r.apel at r-apel.de> - 0:1.2-2jpp
+- Add gcj_support option
+- Optionally build without maven
+
+* Mon Feb 20 2006 Ralph Apel <r.apel at r-apel.de> - 0:1.2-1jpp
+- Upgrade to 1.2
+
+* Mon Feb 20 2006 Ralph Apel <r.apel at r-apel.de> - 0:1.1-2jpp
+- Rebuild for JPP-1.7 and maven-1.1
+
+* Thu Sep 15 2005 Ralph Apel <r.apel at r-apel.de> - 0:1.1-1jpp
+- Upgrade to 1.1
+- Omit findbugs and tasks reports: don't have these plugins yet
+- Requires java 1.4.2 to build
+
+* Mon Feb 21 2005 Ralph Apel <r.apel at r-apel.de> - 0:1.0.f-1jpp
+- Upgrade to 1.0 final, letter in version can be bumped with 1.1
+- Prepare for build with maven, but still build with ant
+
+* Sun Aug 23 2004 Randy Watler <rwatler at finali.com> - 0:1.0.d3-2jpp
+- Rebuild with ant-1.6.2
+- Upgrade to Ant 1.6.X
+
+* Mon Jan 19 2004 Ralph Apel <r.apel at r-apel.de> - 0:1.0.d3-1jpp
+- First JPackage release
--- a/dead.package
+++ b/dead.package
@ -1 +0,0 @@
-Orphaned for 6+ weeks
--- a/2
+++ b/2
@ -0,0 +1,2 @@
+SHA512 (commons-configuration2-2.10.1-src.tar.gz) = cccaa29b59467e1bc08a2c62d84a057f342418003e10b5a0c259c67be2059db38c035224bfe520e48e789e55b656f105079f42486590e29624c35a436fcee257
+SHA512 (commons-configuration2-2.10.1-src.tar.gz.asc) = 048124b6fa7212bc4323c36d1131c6fc68dedfb70241061db5d07bba7989ccd46910cda255f5547477223572f30dcba7f6296f404428c82c09451fe29b0957f5