Fix CVE-2022-0613

resolves: #2055544

.gitignore

@@ -1,2 +1,4 @@
 /bash-language-server-1.17.0-vendor.tar.xz
 /bash-language-server-1.17.0.tar.gz
+/bash-language-server-2.0.0.tar.gz
+/bash-language-server-2.0.0-vendor.tar.xz

README.md

@@ -1,3 +1,12 @@
 # nodejs-bash-language-server
 
 The nodejs-bash-language-server package
+
+## Updating the package
+
+* Update the version in the spec file
+* Run `bash prepare_vendor.sh` (This will download the tarball and create the
+  vendor package)
+* Add a changelog entry to the spec file
+* Upload new source tarballs with `fedpkg new-sources PACKAGE.tar.gz`
+* Commit your stuff to git

bashls-fix-CVE-2022-0613.patch

@@ -0,0 +1,55 @@
+Index: bash-language-server-server-2.0.0/server/package.json
+===================================================================
+--- bash-language-server-server-2.0.0.orig/server/package.json
++++ bash-language-server-server-2.0.0/server/package.json
+@@ -23,7 +23,7 @@
+     "request": "^2.83.0",
+     "request-promise-native": "^1.0.5",
+     "turndown": "^4.0.2",
+-    "urijs": "^1.19.1",
++    "urijs": "^1.19.8",
+     "vscode-languageserver": "^6.1.1",
+     "vscode-languageserver-textdocument": "^1.0.1",
+     "web-tree-sitter": "^0.19.4"
+@@ -36,6 +36,6 @@
+     "@types/glob": "^7.1.1",
+     "@types/request-promise-native": "^1.0.17",
+     "@types/turndown": "^5.0.0",
+-    "@types/urijs": "^1.19.4"
++    "@types/urijs": "^1.19.8"
+   }
+ }
+Index: bash-language-server-server-2.0.0/server/yarn.lock
+===================================================================
+--- bash-language-server-server-2.0.0.orig/server/yarn.lock
++++ bash-language-server-server-2.0.0/server/yarn.lock
+@@ -63,10 +63,10 @@
+   resolved "https://registry.yarnpkg.com/@types/turndown/-/turndown-5.0.0.tgz#2b763b36f783e4e237cea62cdc8f8592b72b9285"
+   integrity sha512-Y7KZn6SfSv1vzjByJGijrM9w99HoUbLiAgYwe+sGH6RYi5diIGLYOcr4Z1YqR2biFs9K5PnxKv/Fbkmh57pvzg==
+ 
+-"@types/urijs@^1.19.4":
+-  version "1.19.4"
+-  resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.4.tgz#29c4a694d4842d7f95e359a26223fc1865f1ab13"
+-  integrity sha512-uHUvuLfy4YkRHL4UH8J8oRsINhdEHd9ymag7KJZVT94CjAmY1njoUzhazJsZjwfy+IpWKQKGVyXCwzhZvg73Fg==
++"@types/urijs@^1.19.8":
++  version "1.19.18"
++  resolved "https://registry.yarnpkg.com/@types/urijs/-/urijs-1.19.18.tgz#bf92d5b7c32bf41fc161c3660b8e3a78a9a4333e"
++  integrity sha512-tjftsOLuIWFLJxcpgFeehNnMhpMIv0ELJl0/i31jiV3au1GQpnd3/pTTDQg2zO5cSGJxtrDzMgebOH7+cqh3Vg==
+ 
+ abab@^1.0.4:
+   version "1.0.4"
+@@ -721,10 +721,10 @@ type-check@~0.3.2:
+   dependencies:
+     prelude-ls "~1.1.2"
+ 
+-urijs@^1.19.1:
+-  version "1.19.7"
+-  resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.7.tgz#4f594e59113928fea63c00ce688fb395b1168ab9"
+-  integrity sha512-Id+IKjdU0Hx+7Zx717jwLPsPeUqz7rAtuVBRLLs+qn+J2nf9NGITWVCxcijgYxBqe83C7sqsQPs6H1pyz3x9gA==
++urijs@^1.19.8:
++  version "1.19.8"
++  resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.8.tgz#ee0407a18528934d3c383e691912f47043a58feb"
++  integrity sha512-iIXHrjomQ0ZCuDRy44wRbyTZVnfVNLVo3Ksz1yxNyE5wV1IDZW2S5Jszy45DTlw/UdsnRT7DyDhIz7Gy+vJumw==
+ 
+ uuid@^3.1.0:
+   version "3.2.1"

nodejs-bash-language-server.spec

@@ -3,14 +3,15 @@
 %define pkg_name bash-language-server
 
 Name:           nodejs-bash-language-server
-Version:        1.17.0
-Release:        1%{?dist}
+Version:        2.0.0
+Release:        2%{?dist}
 Summary:        A language server for Bash
 License:        MIT
 Url:            https://github.com/bash-lsp/bash-language-server
 Source0:        %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz
 # Create with `bash prepare_vendor.sh`
 Source1:        %{pkg_name}-%{version}-vendor.tar.xz
+Patch0:         bashls-fix-CVE-2022-0613.patch
 BuildRequires:  fdupes
 BuildRequires:  nodejs-typescript
 BuildRequires:  nodejs-packaging
@@ -30,7 +31,7 @@ Bash with explainshell integration.
 
 %build
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
-yarn install --offline
+yarn install --offline --frozen-lockfile
 
 npm run compile
 
@@ -38,26 +39,26 @@ npm run compile
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
 
 # Only install production dependencies in node_modules
-yarn install --production --offline
+yarn install --production --offline --frozen-lockfile
 
 for S in $(grep -l '#!.*node' \
-        server/bin/* \
-                     server/node_modules/acorn/bin/* \
-                     server/node_modules/ajv/scripts/* \
-                     server/node_modules/escodegen/bin/* \
-                     server/node_modules/esprima/bin/* \
-                     server/node_modules/performance-now/test/scripts/* \
-                     server/node_modules/pn/scripts/* \
-                     server/node_modules/sshpk/bin/* \
-                     server/node_modules/uuid/bin/* \
-                     server/node_modules/vscode-languageserver/bin/* \
-                     ) ; do
-                     SB="${S}.backup"
-                     cp ${S} ${SB}
-                     perl -p -i -e 's|#!/usr/bin/env node|#!%{_bindir}/node|g' $S
-                     diff -urN ${SB} ${S} || :
-                     rm ${SB}
-                     done
+    server/bin/* \
+    server/node_modules/acorn/bin/* \
+    server/node_modules/ajv/scripts/* \
+    server/node_modules/escodegen/bin/* \
+    server/node_modules/esprima/bin/* \
+    server/node_modules/performance-now/test/scripts/* \
+    server/node_modules/pn/scripts/* \
+    server/node_modules/sshpk/bin/* \
+    server/node_modules/uuid/bin/* \
+    server/node_modules/vscode-languageserver/bin/* \
+    ) ; do
+        SB="${S}.backup"
+        cp ${S} ${SB}
+        perl -p -i -e 's|#!/usr/bin/env node|#!%{_bindir}/node|g' $S
+        diff -urN ${SB} ${S} || :
+        rm ${SB}
+done
 
 install -d -m 0755 %{buildroot}%{_bindir}
 ln -s %{nodejs_sitelib}/%{pkg_name}/bin/main.js %{buildroot}%{_bindir}/%{pkg_name}
@@ -66,6 +67,8 @@ install -d -m 0755 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/
 rsync -av server/ %{buildroot}%{nodejs_sitelib}/%{pkg_name}/
 
 rm -rf %{buildroot}%{nodejs_sitelib}/%{pkg_name}/node_modules/performance-now/test/
+chmod 0644 %{buildroot}%{nodejs_sitelib}/%{pkg_name}/tree-sitter-bash.wasm \
+    %{buildroot}%{nodejs_sitelib}/%{pkg_name}/node_modules/web-tree-sitter/tree-sitter.wasm
 
 find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -name "*.bak" -delete
 find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete
@@ -80,5 +83,13 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete
 %{nodejs_sitelib}/%{pkg_name}/
 
 %changelog
+* Thu Feb 17 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-2
+- resolves: #2055544 - Fix CVE-2022-0613
+
+* Thu Aug 26 2021 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-1
+- Update to version 2.0.0
+  * https://github.com/bash-lsp/bash-language-server/blob/server-2.0.0/server/CHANGELOG.md
+- Fixed indentation for node shebang loop
+
 * Thu Aug 05 2021 Andreas Schneider <asn@redhat.com> - 1.17.0-1
 - Initial package

prepare_vendor.sh

@@ -25,7 +25,7 @@ cleanup_and_exit() {
     if test "$1" = 0 -o -z "$1" ; then
         exit 0
     else
-        exit $1
+        exit "${1}"
     fi
 }
 
@@ -37,7 +37,10 @@ fi
 tar -xf $BASHLS_TARBALL -C $BASHLS_TMPDIR
 
 
-pushd $BASHLS_PATH
+pushd $BASHLS_PATH || cleanup_and_exit 1
+
+# TEMPORARY: Fix CVE-2022-0613
+patch -p1 < "${BASHLS_PKGDIR}/bashls-fix-CVE-2022-0613.patch"
 
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
 echo ">>>>>> Install npm modules"
@@ -48,28 +51,28 @@ if [ $? -ne 0 ]; then
 fi
 
 echo ">>>>>> Cleanup object dirs"
-find node_modules/ -type d -name "*.o.d" | xargs rm -rf
-find node_modules/ -type d -name "__pycache__" | xargs rm -rf
+find ${YARN_CACHE_FOLDER}/ -type d -name "*.o.d" | xargs rm -rf
+find ${YARN_CACHE_FOLDER}/ -type d -name "__pycache__" | xargs rm -rf
 
 
 echo ">>>>>> Cleanup object files"
-find node_modules/ -name "*.node" | xargs rm -rf
+find ${YARN_CACHE_FOLDER}/ -name "*.node" | xargs rm -rf
 
-find node_modules/ -name "*.dll" | grep -v signal-client | xargs rm -f
-find node_modules/ -name "*.dylib" -delete
-find node_modules/ -name "*.so" -delete
-find node_modules/ -name "*.o" -delete
-find node_modules/ -name "*.a" -delete
-find node_modules/ -name "*.snyk-*.flag" -delete
-find node_modules/ -name "builderror.log" -delete
-find node_modules/ -name ".deps" -type d | xargs rm -rf
+find ${YARN_CACHE_FOLDER}/ -name "*.dll" | grep -v signal-client | xargs rm -f
+find ${YARN_CACHE_FOLDER}/ -name "*.dylib" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.so" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.o" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.a" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.snyk-*.flag" -delete
+find ${YARN_CACHE_FOLDER}/ -name "builderror.log" -delete
+find ${YARN_CACHE_FOLDER}/ -name ".deps" -type d | xargs rm -rf
 
 
 echo ">>>>>> Cleanup build info"
-find node_modules/ -name "Makefile" -delete
-find node_modules/ -name "*.target.mk" -delete
-find node_modules/ -name "config.gypi" -delete
-find node_modules/ -name "package.json" -exec sed -i "s#$BASHLS_PATH#/tmp#g" {} \;
+find ${YARN_CACHE_FOLDER}/ -name "Makefile" -delete
+find ${YARN_CACHE_FOLDER}/ -name "*.target.mk" -delete
+find ${YARN_CACHE_FOLDER}/ -name "config.gypi" -delete
+find ${YARN_CACHE_FOLDER}/ -name "package.json" -exec sed -i "s#$BASHLS_PATH#/tmp#g" {} \;
 
 
 echo ">>>>>> Package vendor files"

sources

@@ -1,2 +1,2 @@
-SHA512 (bash-language-server-1.17.0-vendor.tar.xz) = 621880d3d1343bb6f147f5dfd295e46e9b1a1a2dc7f6d193ed865fed72213006bd6d8793553318ed120cbc86c4c2ffa1f2b5f6ecb760bf6c6f051220915fcf4c
-SHA512 (bash-language-server-1.17.0.tar.gz) = 3d16a7de09d54ca2cdd3ae6a1bd7d88e843d37e662859d85bb365d3ed90d1ad9bca17767d8c42c80f9777a799cd38744a5d3b2cf47d6491c37118f1265ce522c
+SHA512 (bash-language-server-2.0.0.tar.gz) = e72df6f13ed4b861b81329059d41cdfada2729e9523e619ef26d6ed0a2a5400a3dda659b4f4af923a2a9fb2054b99b9d6db082508f2ba06ac0f9a421516e2ce9
+SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 14384d60661fb4973b22e18998a9b966aba9a9c252d9c2b139996ec8f208d9db54065f278f216c381f60e76b6fdc70979793d444b56016661bc8f6d4b76172e8