Update to version 3.0.5

resolves: #2055544

.gitignore

@@ -2,3 +2,5 @@
 /bash-language-server-1.17.0.tar.gz
 /bash-language-server-2.0.0.tar.gz
 /bash-language-server-2.0.0-vendor.tar.xz
+/bash-language-server-3.0.5.tar.gz
+/bash-language-server-3.0.5-vendor.tar.xz

bashls-fix-CVE-2022-0613.patch

@@ -0,0 +1,38 @@
+From 5a4920cf4f49c29aade36682a17a38cb979bdfd1 Mon Sep 17 00:00:00 2001
+From: Andreas Schneider <asn@cryptomilk.org>
+Date: Fri, 19 Aug 2022 10:10:31 +0200
+Subject: [PATCH] CVE-2022-0613: Update urijs to v1.19.11
+
+There is a Authorization Bypass Through User-Controlled Key in NPM
+urijs prior to 1.19.8.
+---
+ server/package.json | 2 +-
+ server/yarn.lock    | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/server/package.json b/server/package.json
+index 51f565a4..5f3ba0fb 100644
+--- a/server/package.json
++++ b/server/package.json
+@@ -23,7 +23,7 @@
+     "request": "^2.83.0",
+     "request-promise-native": "^1.0.5",
+     "turndown": "^7.0.0",
+-    "urijs": "^1.19.1",
++    "urijs": "^1.19.11",
+     "vscode-languageserver": "^6.1.1",
+     "vscode-languageserver-textdocument": "^1.0.1",
+     "web-tree-sitter": "^0.20.5"
+diff --git a/server/yarn.lock b/server/yarn.lock
+index 0071aad2..7c752cf2 100644
+--- a/server/yarn.lock
++++ b/server/yarn.lock
+@@ -489,7 +489,7 @@ tweetnacl@^0.14.3, tweetnacl@~0.14.0:
+   resolved "https://registry.yarnpkg.com/tweetnacl/-/tweetnacl-0.14.5.tgz#5ae68177f192d4456269d108afa93ff8743f4f64"
+   integrity sha1-WuaBd/GS1EViadEIr6k/+HQ/T2Q=
+ 
+-urijs@^1.19.1:
++urijs@^1.19.11:
+   version "1.19.11"
+   resolved "https://registry.yarnpkg.com/urijs/-/urijs-1.19.11.tgz#204b0d6b605ae80bea54bea39280cdb7c9f923cc"
+   integrity sha512-HXgFDgDommxn5/bIv0cnQZsPhHDA90NPHD6+c/v21U5+Sx5hoP8+dP9IZXBU1gIfvdRfhG8cel9QNPeionfcCQ==

nodejs-bash-language-server.spec

@@ -3,14 +3,15 @@
 %define pkg_name bash-language-server
 
 Name:           nodejs-bash-language-server
-Version:        2.0.0
+Version:        3.0.5
-Release:        2%{?dist}
+Release:        1%{?dist}
 Summary:        A language server for Bash
 License:        MIT
 Url:            https://github.com/bash-lsp/bash-language-server
 Source0:        %{url}/archive/server-%{version}/%{pkg_name}-%{version}.tar.gz
 # Create with `bash prepare_vendor.sh`
 Source1:        %{pkg_name}-%{version}-vendor.tar.xz
+Patch0:         bashls-fix-CVE-2022-0613.patch
 BuildRequires:  fdupes
 BuildRequires:  nodejs-typescript
 BuildRequires:  nodejs-packaging
@@ -20,6 +21,7 @@ BuildRequires:  rsync
 BuildRequires:  yarnpkg
 BuildArch:      noarch
 ExclusiveArch: %{nodejs_arches} noarch
+Recommends:     ShellCheck
 
 %description
 Bash language server implementation based on Tree Sitter and its grammar for
@@ -30,7 +32,7 @@ Bash with explainshell integration.
 
 %build
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
-yarn install --offline
+yarn install --offline --frozen-lockfile
 
 npm run compile
 
@@ -38,7 +40,7 @@ npm run compile
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
 
 # Only install production dependencies in node_modules
-yarn install --production --offline
+yarn install --production --offline --frozen-lockfile
 
 for S in $(grep -l '#!.*node' \
     server/bin/* \
@@ -82,6 +84,15 @@ find %{buildroot}%{nodejs_sitelib}/%{pkg_name} -type f -name "\.*" -delete
 %{nodejs_sitelib}/%{pkg_name}/
 
 %changelog
+* Fri Aug 19 2022 Pavel Filipenský <pfilipen@redhat.com> - 3.0.5-1
+- Update to version 3.0.5
+  * https://github.com/bash-lsp/bash-language-server/blob/server-3.0.5/server/CHANGELOG.md
+- Linting based on shellcheck
+- Update bashls-fix-CVE-2022-0613.patch with content of https://patch-diff.githubusercontent.com/raw/bash-lsp/bash-language-server/pull/489.patch
+
+* Thu Feb 17 2022 Pavel Filipenský <pfilipen@redhat.com> - 2.0.0-3
+- resolves: #2055544 - Fix CVE-2022-0613
+
 * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.0-2
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
 

prepare_vendor.sh

@@ -25,7 +25,7 @@ cleanup_and_exit() {
     if test "$1" = 0 -o -z "$1" ; then
         exit 0
     else
-        exit $1
+        exit "${1}"
     fi
 }
 
@@ -37,7 +37,10 @@ fi
 tar -xf $BASHLS_TARBALL -C $BASHLS_TMPDIR
 
 
-pushd $BASHLS_PATH
+pushd $BASHLS_PATH || cleanup_and_exit 1
+
+# TEMPORARY: Fix CVE-2022-0613
+patch -p1 < "${BASHLS_PKGDIR}/bashls-fix-CVE-2022-0613.patch"
 
 export YARN_CACHE_FOLDER="$(pwd)/.package-cache"
 echo ">>>>>> Install npm modules"

sources

@@ -1,2 +1,2 @@
-SHA512 (bash-language-server-2.0.0.tar.gz) = e72df6f13ed4b861b81329059d41cdfada2729e9523e619ef26d6ed0a2a5400a3dda659b4f4af923a2a9fb2054b99b9d6db082508f2ba06ac0f9a421516e2ce9
+SHA512 (bash-language-server-3.0.5.tar.gz) = fc0a92b905efcec22f4a7c7ee2f1318d56b2392851bffff67451d084ac784363c16cbef19fd17ffd5f54fb11d254a99f7ca3e62ff73ae98cb15d37b6b17325ed
-SHA512 (bash-language-server-2.0.0-vendor.tar.xz) = 2ce21b7296a5813afeb48b7cf27d2c19eb0b80d5355e3ef276e6da0c8710f6216a4bed498125956a6412ee670acafd0d25f55cdb7527a4b1c934d033a875b748
+SHA512 (bash-language-server-3.0.5-vendor.tar.xz) = 2017892eed1f0fab6ac1af110dc38ee995915f627c1e01a5f9f61be3ede90281172da041be3dd7131452234580119ba1d6545f828539e59411b80bb2a010343d