rpms/nodejs-bash-language-server
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix CVE-2022-0613

Browse source 
resolves: #2055544
This commit is contained in:
Pavel Filipenský 2022-02-17 12:11:23 +01:00
commit abb0411f09
4 changed files with 68 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

55
bashls-fix-CVE-2022-0613.patch Normal file
View file

@ -0,0 +1,55 @@
Index: bash-language-server-server-2.0.0/server/package.json
===================================================================
--- bash-language-server-server-2.0.0.orig/server/package.json
+++ bash-language-server-server-2.0.0/server/package.json
@@ -23,7 +23,7 @@
"request": "^2.83.0",
"request-promise-native": "^1.0.5",
"turndown": "^4.0.2",
- "urijs": "^1.19.1",
+ "urijs": "^1.19.8",
"vscode-languageserver": "^6.1.1",
"vscode-languageserver-textdocument": "^1.0.1",
"web-tree-sitter": "^0.19.4"
@@ -36,6 +36,6 @@
"@types/glob": "^7.1.1",
"@types/request-promise-native": "^1.0.17",
"@types/turndown": "^5.0.0",
- "@types/urijs": "^1.19.4"
+ "@types/urijs": "^1.19.8"
}
}
Index: bash-language-server-server-2.0.0/server/yarn.lock
===================================================================
--- bash-language-server-server-2.0.0.orig/server/yarn.lock
+++ bash-language-server-server-2.0.0/server/yarn.lock
@@ -63,10 +63,10 @@
resolved "https://registry.yarnpkg.com/@types/turndown/-/turndown-5.0.0.tgz#2b763b36f783e4e237cea62cdc8f8592b72b9285"
integrity sha512-Y7KZn6SfSv1vzjByJGijrM9w99HoUbLiAgYwe+sGH6RYi5diIGLYOcr4Z1YqR2biFs9K5PnxKv/Fbkmh57pvzg==
-"@types/urijs@^1.19.4":
- version "1.19.4"
- resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.4.tgz#29c4a694d4842d7f95e359a26223fc1865f1ab13"
- integrity sha512-uHUvuLfy4YkRHL4UH8J8oRsINhdEHd9ymag7KJZVT94CjAmY1njoUzhazJsZjwfy+IpWKQKGVyXCwzhZvg73Fg==
+"@types/urijs@^1.19.8":
+ version "1.19.18"
+ resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.18.tgz#bf92d5b7c32bf41fc161c3660b8e3a78a9a4333e"
+ integrity sha512-tjftsOLuIWFLJxcpgFeehNnMhpMIv0ELJl0/i31jiV3au1GQpnd3/pTTDQg2zO5cSGJxtrDzMgebOH7+cqh3Vg==
abab@^1.0.4:
version "1.0.4"
@@ -721,10 +721,10 @@ type-check@~0.3.2:
dependencies:
prelude-ls "~1.1.2"
-urijs@^1.19.1:
- version "1.19.7"
- resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.7.tgz#4f594e59113928fea63c00ce688fb395b1168ab9"
- integrity sha512-Id+IKjdU0Hx+7Zx717jwLPsPeUqz7rAtuVBRLLs+qn+J2nf9NGITWVCxcijgYxBqe83C7sqsQPs6H1pyz3x9gA==
+urijs@^1.19.8:
+ version "1.19.8"
+ resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.8.tgz#ee0407a18528934d3c383e691912f47043a58feb"
+ integrity sha512-iIXHrjomQ0ZCuDRy44wRbyTZVnfVNLVo3Ksz1yxNyE5wV1IDZW2S5Jszy45DTlw/UdsnRT7DyDhIz7Gy+vJumw==
uuid@^3.1.0:
version "3.2.1"

10
nodejs-bash-language-server.spec
View file

@ -4,13 +4,14 @@
Name: nodejs-bash-language-server
Version: 2.0.0
Release: 1%{?dist}
Release: 2%{?dist}
Summary: A language server for Bash
License: MIT
Url: https://github.com/bash-lsp/bash-language-server
Source0: %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz
# Create with `bash prepare_vendor.sh`
Source1: %{pkg_name}-%{version}-vendor.tar.xz
Patch0: bashls-fix-CVE-2022-0613.patch
BuildRequires: fdupes
BuildRequires: nodejs-typescript
BuildRequires: nodejs-packaging
@ -30,7 +31,7 @@ Bash with explainshell integration.
%build
export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
yarn install --offline
yarn install --offline --frozen-lockfile
npm run compile
@ -38,7 +39,7 @@ npm run compile
export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
# Only install production dependencies in node_modules
yarn install --production --offline
yarn install --production --offline --frozen-lockfile
for S in $(grep -l '#!.*node' \
server/bin/* \
@ -82,6 +83,9 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete
%{nodejs_sitelib}/%{pkg_name}/
%changelog
* Thu Feb 17 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-2
- resolves: #2055544 - Fix CVE-2022-0613
* Thu Aug 26 2021 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-1
- Update to version 2.0.0
* https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md

7
prepare_vendor.sh
View file

@ -25,7 +25,7 @@ cleanup_and_exit() {
if test "$1" = 0 -o -z "$1" ; then
exit 0
else
exit $1
exit "${1}"
fi
}
@ -37,7 +37,10 @@ fi
tar -xf $BASHLS_TARBALL -C $BASHLS_TMPDIR
pushd $BASHLS_PATH
pushd $BASHLS_PATH || cleanup_and_exit 1
# TEMPORARY: Fix CVE-2022-0613
patch -p1 < "${BASHLS_PKGDIR}/bashls-fix-CVE-2022-0613.patch"
export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
echo ">>>>>> Install npm modules"

2
sources
View file

@ -1,2 +1,2 @@
SHA512 (bash-language-server-2.0.0.tar.gz) = e72df6f13ed4b861b81329059d41cdfada2729e9523e619ef26d6ed0a2a5400a3dda659b4f4af923a2a9fb2054b99b9d6db082508f2ba06ac0f9a421516e2ce9
SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 2ce21b7296a5813afeb48b7cf27d2c19eb0b80d5355e3ef276e6da0c8710f6216a4bed498125956a6412ee670acafd0d25f55cdb7527a4b1c934d033a875b748
SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 14384d60661fb4973b22e18998a9b966aba9a9c252d9c2b139996ec8f208d9db54065f278f216c381f60e76b6fdc70979793d444b56016661bc8f6d4b76172e8