From abb0411f090735e256ffaa8c462ddf5ff80d3d1f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pavel=20Filipensk=C3=BD?= Date: Thu, 17 Feb 2022 12:11:23 +0100 Subject: [PATCH] Fix CVE-2022-0613 resolves: #2055544 --- bashls-fix-CVE-2022-0613.patch | 55 ++++++++++++++++++++++++++++++++ nodejs-bash-language-server.spec | 10 ++++-- prepare_vendor.sh | 7 ++-- sources | 2 +- 4 files changed, 68 insertions(+), 6 deletions(-) create mode 100644 bashls-fix-CVE-2022-0613.patch diff --git a/bashls-fix-CVE-2022-0613.patch b/bashls-fix-CVE-2022-0613.patch new file mode 100644 index 0000000..ae09185 --- /dev/null +++ b/bashls-fix-CVE-2022-0613.patch @@ -0,0 +1,55 @@ +Index: bash-language-server-server-2.0.0/server/package.json +=================================================================== +--- bash-language-server-server-2.0.0.orig/server/package.json ++++ bash-language-server-server-2.0.0/server/package.json +@@ -23,7 +23,7 @@ + "request": "^2.83.0", + "request-promise-native": "^1.0.5", + "turndown": "^4.0.2", +- "urijs": "^1.19.1", ++ "urijs": "^1.19.8", + "vscode-languageserver": "^6.1.1", + "vscode-languageserver-textdocument": "^1.0.1", + "web-tree-sitter": "^0.19.4" +@@ -36,6 +36,6 @@ + "@types/glob": "^7.1.1", + "@types/request-promise-native": "^1.0.17", + "@types/turndown": "^5.0.0", +- "@types/urijs": "^1.19.4" ++ "@types/urijs": "^1.19.8" + } + } +Index: bash-language-server-server-2.0.0/server/yarn.lock +=================================================================== +--- bash-language-server-server-2.0.0.orig/server/yarn.lock ++++ bash-language-server-server-2.0.0/server/yarn.lock +@@ -63,10 +63,10 @@ + resolved "https://registry.yarnpkg.com/@types/turndown/-/turndown-5.0.0.tgz#2b763b36f783e4e237cea62cdc8f8592b72b9285" + integrity sha512-Y7KZn6SfSv1vzjByJGijrM9w99HoUbLiAgYwe+sGH6RYi5diIGLYOcr4Z1YqR2biFs9K5PnxKv/Fbkmh57pvzg== + +-"@types/urijs@^1.19.4": +- version "1.19.4" +- resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.4.tgz#29c4a694d4842d7f95e359a26223fc1865f1ab13" +- integrity sha512-uHUvuLfy4YkRHL4UH8J8oRsINhdEHd9ymag7KJZVT94CjAmY1njoUzhazJsZjwfy+IpWKQKGVyXCwzhZvg73Fg== ++"@types/urijs@^1.19.8": ++ version "1.19.18" ++ resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.18.tgz#bf92d5b7c32bf41fc161c3660b8e3a78a9a4333e" ++ integrity sha512-tjftsOLuIWFLJxcpgFeehNnMhpMIv0ELJl0/i31jiV3au1GQpnd3/pTTDQg2zO5cSGJxtrDzMgebOH7+cqh3Vg== + + abab@^1.0.4: + version "1.0.4" +@@ -721,10 +721,10 @@ type-check@~0.3.2: + dependencies: + prelude-ls "~1.1.2" + +-urijs@^1.19.1: +- version "1.19.7" +- resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.7.tgz#4f594e59113928fea63c00ce688fb395b1168ab9" +- integrity sha512-Id+IKjdU0Hx+7Zx717jwLPsPeUqz7rAtuVBRLLs+qn+J2nf9NGITWVCxcijgYxBqe83C7sqsQPs6H1pyz3x9gA== ++urijs@^1.19.8: ++ version "1.19.8" ++ resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.8.tgz#ee0407a18528934d3c383e691912f47043a58feb" ++ integrity sha512-iIXHrjomQ0ZCuDRy44wRbyTZVnfVNLVo3Ksz1yxNyE5wV1IDZW2S5Jszy45DTlw/UdsnRT7DyDhIz7Gy+vJumw== + + uuid@^3.1.0: + version "3.2.1" diff --git a/nodejs-bash-language-server.spec b/nodejs-bash-language-server.spec index 74d9fc7..5022757 100644 --- a/nodejs-bash-language-server.spec +++ b/nodejs-bash-language-server.spec @@ -4,13 +4,14 @@ Name: nodejs-bash-language-server Version: 2.0.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A language server for Bash License: MIT Url: https://github.com/bash-lsp/bash-language-server Source0: %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz # Create with `bash prepare_vendor.sh` Source1: %{pkg_name}-%{version}-vendor.tar.xz +Patch0: bashls-fix-CVE-2022-0613.patch BuildRequires: fdupes BuildRequires: nodejs-typescript BuildRequires: nodejs-packaging @@ -30,7 +31,7 @@ Bash with explainshell integration. %build export YARN_CACHE_FOLDER="$(pwd)/.package-cache" -yarn install --offline +yarn install --offline --frozen-lockfile npm run compile @@ -38,7 +39,7 @@ npm run compile export YARN_CACHE_FOLDER="$(pwd)/.package-cache" # Only install production dependencies in node_modules -yarn install --production --offline +yarn install --production --offline --frozen-lockfile for S in $(grep -l '#!.*node' \ server/bin/* \ @@ -82,6 +83,9 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete %{nodejs_sitelib}/%{pkg_name}/ %changelog +* Thu Feb 17 2022 Pavel Filipenský - 2.0.0-2 +- resolves: #2055544 - Fix CVE-2022-0613 + * Thu Aug 26 2021 Pavel Filipenský - 2.0.0-1 - Update to version 2.0.0 * https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md diff --git a/prepare_vendor.sh b/prepare_vendor.sh index 5fb9766..8a02610 100644 --- a/prepare_vendor.sh +++ b/prepare_vendor.sh @@ -25,7 +25,7 @@ cleanup_and_exit() { if test "$1" = 0 -o -z "$1" ; then exit 0 else - exit $1 + exit "${1}" fi } @@ -37,7 +37,10 @@ fi tar -xf $BASHLS_TARBALL -C $BASHLS_TMPDIR -pushd $BASHLS_PATH +pushd $BASHLS_PATH || cleanup_and_exit 1 + +# TEMPORARY: Fix CVE-2022-0613 +patch -p1 < "${BASHLS_PKGDIR}/bashls-fix-CVE-2022-0613.patch" export YARN_CACHE_FOLDER="$(pwd)/.package-cache" echo ">>>>>> Install npm modules" diff --git a/sources b/sources index db8cbd5..8851f0f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (bash-language-server-2.0.0.tar.gz) = e72df6f13ed4b861b81329059d41cdfada2729e9523e619ef26d6ed0a2a5400a3dda659b4f4af923a2a9fb2054b99b9d6db082508f2ba06ac0f9a421516e2ce9 -SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 2ce21b7296a5813afeb48b7cf27d2c19eb0b80d5355e3ef276e6da0c8710f6216a4bed498125956a6412ee670acafd0d25f55cdb7527a4b1c934d033a875b748 +SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 14384d60661fb4973b22e18998a9b966aba9a9c252d9c2b139996ec8f208d9db54065f278f216c381f60e76b6fdc70979793d444b56016661bc8f6d4b76172e8