diff --git a/.gitignore b/.gitignore index 9649f3e..27b299d 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,10 @@ -/json-*.gem -/rubygem-json-*-missing-files.tar.gz +json-1.1.7.gem +/json-1.4.6.gem +/json-1.6.5.gem +/json-1.7.7.gem +/json-1.8.2.gem +/json-1.8.3.gem +/json-2.0.3.gem +/json-2.0.4.gem +/json-2.1.0.gem +/json-2.2.0.gem diff --git a/json-create-tarball-missing-files.sh b/json-create-tarball-missing-files.sh deleted file mode 100644 index b980a86..0000000 --- a/json-create-tarball-missing-files.sh +++ /dev/null @@ -1,33 +0,0 @@ -#!/bin/bash - -set -x -set -e - -if [ $# -lt 1 ] -then - echo "$0 " - exit 1 -fi - -NAME=json - -CURRDIR=$(pwd) - -TMPDIRPATH=$(mktemp -d /var/tmp/${NAME}-tar-XXXXXX) -pushd $TMPDIRPATH - -VERSION=$1 - -git clone https://github.com/flori/${NAME}.git -pushd json -git reset --hard v${VERSION} || false -popd - -ln -sf ${NAME} ${NAME}-${VERSION} -tar czf ${CURRDIR}/rubygem-${NAME}-${VERSION}-missing-files.tar.gz \ - ${NAME}-${VERSION}/./test/ - -popd - -rm -rf $TMPDIRPATH - diff --git a/rubygem-json-2.2.0-CVE-2020-10663-backport.patch b/rubygem-json-2.2.0-CVE-2020-10663-backport.patch new file mode 100644 index 0000000..2b3523e --- /dev/null +++ b/rubygem-json-2.2.0-CVE-2020-10663-backport.patch @@ -0,0 +1,40 @@ +From 36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01 Mon Sep 17 00:00:00 2001 +From: nagachika +Date: Fri, 20 Mar 2020 08:12:05 +0000 +Subject: [PATCH] backport 80b5a0ff2a7709367178f29d4ebe1c54122b1c27 partially + as a securify fix for CVE-2020-10663. The patch was provided by Jeremy Evans. + +git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67856 b2dd03c8-39d4-4d8f-98ff-823fe69b080e +--- + ext/json/parser/parser.c | 2 +- + ext/json/parser/parser.rl | 2 +- + version.h | 2 +- + 3 files changed, 3 insertions(+), 3 deletions(-) + +diff --git a/ext/json/parser/parser.c b/ext/json/parser/parser.c +index b02aae8fb980..027fbcc26f9d 100644 +--- a/ext/json/parser/parser.c ++++ b/ext/json/parser/parser.c +@@ -1835,7 +1835,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self) + } else { + json->max_nesting = 100; + json->allow_nan = 0; +- json->create_additions = 1; ++ json->create_additions = 0; + json->create_id = rb_funcall(mJSON, i_create_id, 0); + json->object_class = Qnil; + json->array_class = Qnil; +diff --git a/ext/json/parser/parser.rl b/ext/json/parser/parser.rl +index d4e7a60e9d1e..fb0bb515decb 100644 +--- a/ext/json/parser/parser.rl ++++ b/ext/json/parser/parser.rl +@@ -730,7 +730,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self) + } else { + json->max_nesting = 100; + json->allow_nan = 0; +- json->create_additions = 1; ++ json->create_additions = 0; + json->create_id = rb_funcall(mJSON, i_create_id, 0); + json->object_class = Qnil; + json->array_class = Qnil; + diff --git a/rubygem-json.spec b/rubygem-json.spec index 5bd931e..0d24bfe 100644 --- a/rubygem-json.spec +++ b/rubygem-json.spec @@ -1,31 +1,28 @@ %global gem_name json -%global pkg_version_num 2.18.0 -%dnl %global pkg_version_alpha -%global gem_version() %{pkg_version_num}%{?pkg_version_alpha:.%pkg_version_alpha} - Name: rubygem-%{gem_name} -Version: %{pkg_version_num}%{?pkg_version_alpha:~%pkg_version_alpha} -Release: 1%{?dist} +Version: 2.2.0 +Release: 202%{?dist} Summary: A JSON implementation in Ruby -# SPDX confirmed -License: Ruby OR BSD-2-Clause -URL: https://github.com/flori/json -Source0: https://rubygems.org/gems/%{gem_name}-%{gem_version}.gem -Source1: rubygem-%{gem_name}-%{gem_version}-missing-files.tar.gz -# Source1 is created by $ %%SOURCE2 v%%version -Source2: json-create-tarball-missing-files.sh + +License: Ruby or GPLv2 +URL: http://json.rubyforge.org +Source0: http://gems.rubyforge.org/gems/%{gem_name}-%{version}.gem +# https://hackerone.com/reports/706934 +# https://github.com/ruby/ruby/commit/36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01 +# https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/ +Patch1: rubygem-json-2.2.0-CVE-2020-10663-backport.patch + BuildRequires: gcc -BuildRequires: ruby(release) -BuildRequires: ruby-devel +BuildRequires: ruby(release) +BuildRequires: ruby-devel BuildRequires: rubygems-devel BuildRequires: rubygem(rake) -BuildRequires: rubygem(bigdecimal) -BuildRequires: rubygem(test-unit-ruby-core) -BuildRequires: rubygem(test-unit) +BuildRequires: rubygem(bigdecimal) +BuildRequires: rubygem(test-unit) Obsoletes: rubygem-%{gem_name}-gui < %{version} Obsoletes: ruby-%{gem_name}-gui < %{version} @@ -47,21 +44,44 @@ Requires: %{name} = %{version}-%{release} This package contains documentation for %{name}. %prep -%global version %gem_version +%setup -q -c -T -%setup -q -n %{gem_name}-%{gem_version} -a 1 -mv ./%{gem_name}-%{version}/test . -mv ../%{gem_name}-%{version}.gemspec . +# Gem repack +TOPDIR=$(pwd) +mkdir tmpunpackdir +pushd tmpunpackdir + +gem unpack %{SOURCE0} +cd %{gem_name}-%{version} + +( +pushd ext/json/ext/ +%patch1 -p3 +popd +) # Change cflags to honor Fedora compiler flags correctly find . -name extconf.rb | xargs sed -i -e 's|-O3|-O2|' -e 's|-O0|-O2|' +gem specification -l --ruby %{SOURCE0} > %{gem_name}.gemspec +gem build %{gem_name}.gemspec +mv %{gem_name}-%{version}.gem $TOPDIR + +popd +rm -rf tmpunpackdir + + %build -gem build %{gem_name}-%{version}.gemspec %gem_install find . -name \*gem -exec chmod 0644 {} \; +# compile again +find . -name extconf.rb | while read f +do + make -C $(dirname $f) clean all install +done + # remove pure rm -fr .%{gem_instdir}/lib/json/pure* @@ -82,198 +102,52 @@ find $RPM_BUILD_ROOT%{gem_instdir} -name \*.rb -print0 | \ xargs --null chmod 0644 # We don't need those files anymore. -pushd $RPM_BUILD_ROOT%{gem_instdir} -rm -rf \ - %{gem_name}.gemspec \ - Gemfile \ - ext \ - java \ - lib/json/truffle_ruby/ \ - test \ - %{nil} -popd +rm -rf $RPM_BUILD_ROOT%{gem_instdir}/ext +rm -rf $RPM_BUILD_ROOT%{gem_instdir}/install.rb +rm -rf $RPM_BUILD_ROOT%{gem_instdir}/{.require_paths,.gitignore,.travis.yml} +rm -rf $RPM_BUILD_ROOT%{gem_instdir}/lib/json/ext/ +rm -rf $RPM_BUILD_ROOT%{gem_instdir}/diagrams +rm -rf $RPM_BUILD_ROOT%{gem_docdir}/rdoc/classes/.src +rm -rf $RPM_BUILD_ROOT%{gem_docdir}/rdoc/classes/.html + +rm -rf $RPM_BUILD_ROOT%{gem_instdir}/java/ %check -rm -rf .%{gem_instdir}/test -cp -a ./test .%{gem_instdir}/ - pushd .%{gem_instdir} -ruby -Ilib:test:test/json:$RPM_BUILD_ROOT%{gem_extdir_mri}:. \ - -e "gem 'test-unit'; require 'test_helper' ; Dir.glob('test/json/*_test.rb').sort.each {|f| require f}" +ruby -Ilib:$RPM_BUILD_ROOT%{gem_extdir_mri}:. \ + -e "gem 'test-unit'; Dir.glob('tests/test_*.rb').sort.each {|f| require f}" popd %files +%doc %{gem_instdir}/[A-Z]* %dir %{gem_instdir} %dir %{gem_libdir} %dir %{gem_libdir}/%{gem_name} - -%license %{gem_instdir}/BSDL -%license %{gem_instdir}/COPYING -%license %{gem_instdir}/LEGAL -%doc %{gem_instdir}/CHANGES.md -%doc %{gem_instdir}/README.md - +%{gem_instdir}/tools/ %{gem_libdir}/%{gem_name}.rb %{gem_libdir}/%{gem_name}/add %{gem_libdir}/%{gem_name}/common.rb %{gem_libdir}/%{gem_name}/ext.rb -%dir %{gem_libdir}/%{gem_name}/ext -%dir %{gem_libdir}/%{gem_name}/ext/generator/ -%{gem_libdir}/%{gem_name}/ext/generator/*.rb %{gem_libdir}/%{gem_name}/version.rb %{gem_libdir}/%{gem_name}/generic_object.rb - %{ruby_libdir}/json* %{ruby_libarchdir}/json* %{gem_extdir_mri}/ %{gem_spec} - %exclude %{gem_cache} +%exclude %{gem_instdir}/Rakefile %files doc +%{gem_instdir}/references/ +%{gem_instdir}/*gemspec %{gem_docdir}/ +%exclude %{gem_instdir}/tests %changelog -* Fri Jan 09 2026 Mamoru TASAKA - 2.18.0-1 -- 2.18.0 - -* Tue Oct 07 2025 Mamoru TASAKA - 2.15.1-1 -- 2.15.1 - -* Thu Sep 25 2025 Mamoru TASAKA - 2.15.0-1 -- 2.15.0 - -* Thu Jul 31 2025 Mamoru TASAKA - 2.13.2-1 -- 2.13.2 - -* Fri Jul 25 2025 Fedora Release Engineering - 2.12.2-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue May 27 2025 Mamoru TASAKA - 2.12.2-1 -- 2.12.2 - -* Fri May 16 2025 Mamoru TASAKA - 2.12.0-1 -- 2.12.0 - -* Tue Apr 29 2025 Mamoru TASAKA - 2.11.3-1 -- 2.11.3 - -* Wed Mar 12 2025 Mamoru TASAKA - 2.10.2-1 -- 2.10.2 - -* Tue Feb 11 2025 Mamoru TASAKA - 2.10.1-1 -- 2.10.1 - -* Sat Jan 18 2025 Fedora Release Engineering - 2.9.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Tue Jan 07 2025 Mamoru TASAKA - 2.9.1-2 -- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 - -* Thu Dec 19 2024 Mamoru TASAKA - 2.9.1-1 -- 2.9.1 - -* Thu Dec 05 2024 Mamoru TASAKA - 2.9.0-1 -- 2.9.0 - -* Thu Nov 07 2024 Mamoru TASAKA - 2.8.1-1 -- 2.8.1 - -* Sat Nov 02 2024 Mamoru TASAKA - 2.8.0~alpha1-14 -- 2.8.0 alpha1 (e660b61) - -* Fri Nov 01 2024 Mamoru TASAKA - 2.7.5-201 -- Apply upstream patch for JSON.generate behavior, restoring activesupport json - usage - -* Wed Oct 30 2024 Mamoru TASAKA - 2.7.5-200 -- 2.7.5 - -* Fri Jul 19 2024 Fedora Release Engineering - 2.7.2-201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Thu Apr 04 2024 Mamoru TASAKA - 2.7.2-200 -- 2.7.2 - -* Fri Jan 26 2024 Fedora Release Engineering - 2.7.1-203 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Mon Jan 22 2024 Fedora Release Engineering - 2.7.1-202 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Jan 03 2024 Mamoru TASAKA - 2.7.1-201 -- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - -* Tue Dec 5 2023 Mamoru TASAKA - 2.7.1-200 -- 2.7.1 - -* Sun Dec 3 2023 Mamoru TASAKA - 2.7.0-201 -- Backport upstream patch for JSON.dump regression for hash - -* Fri Dec 1 2023 Mamoru TASAKA - 2.7.0-200 -- 2.7.0 - -* Fri Jul 21 2023 Fedora Release Engineering - 2.6.3-204 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Fri Apr 21 2023 Mamoru TASAKA - 2.6.3-203 -- SPDX migration - -* Fri Jan 20 2023 Fedora Release Engineering - 2.6.3-202 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Tue Jan 03 2023 Vít Ondruch - 2.6.3-201 -- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_3.2 - -* Mon Dec 5 2022 Mamoru TASAKA - 2.6.3-200 -- 2.6.3 - -* Wed Oct 5 2022 Mamoru TASAKA - 2.6.2-202 -- Remove no longer needed recompilation - -* Sat Jul 23 2022 Fedora Release Engineering - 2.6.2-201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Wed May 18 2022 Mamoru TASAKA - 2.6.2-200 -- 2.6.2 - -* Wed Jan 26 2022 Mamoru TASAKA - 2.6.1-202 -- F-36: rebuild against ruby31 - -* Fri Jan 21 2022 Fedora Release Engineering - 2.6.1-201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Sun Oct 24 2021 Mamoru TASAKA - 2.6.1-200 -- 2.6.1 - -* Fri Oct 22 2021 Mamoru TASAKA - 2.6.0-200 -- 2.6.0 - -* Fri Jul 23 2021 Fedora Release Engineering - 2.5.1-202 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Wed Jan 27 2021 Fedora Release Engineering - 2.5.1-201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jan 6 2021 Mamoru TASAKA - 2.5.1-200 -- 2.5.1 - -* Wed Jul 29 2020 Fedora Release Engineering - 2.3.1-201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Thu Jul 2 2020 Mamoru TASAKA - 2.3.1-200 -- 2.3.1 - -* Tue Apr 14 2020 Vít Ondruch - 2.3.0-202 -- Avoid unexpected JRuby dependency. - -* Thu Jan 30 2020 Fedora Release Engineering - 2.3.0-201 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - -* Fri Jan 17 2020 Mamoru TASAKA - 2.3.0-200 -- 2.3.0 +* Sat Apr 25 2020 Mamoru TASAKA - 2.2.0-202 +- Backport fix for CVE-2020-10663 from 2.3.0 (bug 1827500) * Fri Jul 26 2019 Fedora Release Engineering - 2.2.0-201 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild diff --git a/sources b/sources index 93dc102..2f88465 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (json-2.18.0.gem) = 02b25232a78f0da5bab6db01771385bb0bcefbd6f182314474ca23b61af6a2ec0a66b160ec7a9a3d6c75ccd3a57da08897400fe2673f5cca6a650e133029b884 -SHA512 (rubygem-json-2.18.0-missing-files.tar.gz) = 73453c9e4312ede95f5a3a794cf86f8d138be5425e40e410326fab3592c22710837e5e2c118c4e947466042e6d300a0bd7cb652a3325bb3b9e617705356411da +SHA512 (json-2.2.0.gem) = 855d5cbeb6e62a7deb009ad454944430c0370cc98c53a1126d8ca3cac4b11a191bfb2ded84a957d4caa0f59cc9b6308e320a58569bddba8d6984078ea34703f2