Backport fix for CVE-2020-10663 from 2.3.0 (bug 1827500)

.gitignore

@@ -1,2 +1,10 @@
-/json-*.gem
-/rubygem-json-*-missing-files.tar.gz
+json-1.1.7.gem
+/json-1.4.6.gem
+/json-1.6.5.gem
+/json-1.7.7.gem
+/json-1.8.2.gem
+/json-1.8.3.gem
+/json-2.0.3.gem
+/json-2.0.4.gem
+/json-2.1.0.gem
+/json-2.2.0.gem

json-create-tarball-missing-files.sh

@@ -1,33 +0,0 @@
-#!/bin/bash
-
-set -x
-set -e
-
-if [ $# -lt 1 ]
-then
-  echo "$0 <version>"
-  exit 1
-fi
-
-NAME=json
-
-CURRDIR=$(pwd)
-
-TMPDIRPATH=$(mktemp -d /var/tmp/${NAME}-tar-XXXXXX)
-pushd $TMPDIRPATH
-
-VERSION=$1
-
-git clone https://github.com/flori/${NAME}.git
-pushd json
-git reset --hard v${VERSION} || false
-popd
-
-ln -sf ${NAME} ${NAME}-${VERSION}
-tar czf ${CURRDIR}/rubygem-${NAME}-${VERSION}-missing-files.tar.gz \
-	${NAME}-${VERSION}/./test/
-
-popd
-
-rm -rf $TMPDIRPATH
-

rubygem-json-2.2.0-CVE-2020-10663-backport.patch

@@ -0,0 +1,40 @@
+From 36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01 Mon Sep 17 00:00:00 2001
+From: nagachika <nagachika@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
+Date: Fri, 20 Mar 2020 08:12:05 +0000
+Subject: [PATCH] backport 80b5a0ff2a7709367178f29d4ebe1c54122b1c27 partially
+ as a securify fix for CVE-2020-10663. The patch was provided by Jeremy Evans.
+
+git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67856 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
+---
+ ext/json/parser/parser.c  | 2 +-
+ ext/json/parser/parser.rl | 2 +-
+ version.h                 | 2 +-
+ 3 files changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/ext/json/parser/parser.c b/ext/json/parser/parser.c
+index b02aae8fb980..027fbcc26f9d 100644
+--- a/ext/json/parser/parser.c
++++ b/ext/json/parser/parser.c
+@@ -1835,7 +1835,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
+     } else {
+         json->max_nesting = 100;
+         json->allow_nan = 0;
+-        json->create_additions = 1;
++        json->create_additions = 0;
+         json->create_id = rb_funcall(mJSON, i_create_id, 0);
+         json->object_class = Qnil;
+         json->array_class = Qnil;
+diff --git a/ext/json/parser/parser.rl b/ext/json/parser/parser.rl
+index d4e7a60e9d1e..fb0bb515decb 100644
+--- a/ext/json/parser/parser.rl
++++ b/ext/json/parser/parser.rl
+@@ -730,7 +730,7 @@ static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self)
+     } else {
+         json->max_nesting = 100;
+         json->allow_nan = 0;
+-        json->create_additions = 1;
++        json->create_additions = 0;
+         json->create_id = rb_funcall(mJSON, i_create_id, 0);
+         json->object_class = Qnil;
+         json->array_class = Qnil;
+

rubygem-json.spec

@@ -1,31 +1,28 @@
 %global	gem_name	json
 
-%global	pkg_version_num		2.18.0
-%dnl		%global	pkg_version_alpha
-%global	gem_version()		%{pkg_version_num}%{?pkg_version_alpha:.%pkg_version_alpha}
-
 Name:           rubygem-%{gem_name}
-Version:        %{pkg_version_num}%{?pkg_version_alpha:~%pkg_version_alpha}
-Release:        1%{?dist}
+Version:        2.2.0
+Release:        202%{?dist}
 
 Summary:        A JSON implementation in Ruby
 
-# SPDX confirmed
-License:        Ruby OR BSD-2-Clause
-URL:            https://github.com/flori/json
-Source0:        https://rubygems.org/gems/%{gem_name}-%{gem_version}.gem
-Source1:        rubygem-%{gem_name}-%{gem_version}-missing-files.tar.gz
-# Source1 is created by $ %%SOURCE2 v%%version
-Source2:        json-create-tarball-missing-files.sh
+
+License:        Ruby or GPLv2
+URL:            http://json.rubyforge.org
+Source0:        http://gems.rubyforge.org/gems/%{gem_name}-%{version}.gem
+# https://hackerone.com/reports/706934
+# https://github.com/ruby/ruby/commit/36e9ed7fef6eb2d14becf6c52452e4ab16e4bf01
+# https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/
+Patch1:         rubygem-json-2.2.0-CVE-2020-10663-backport.patch
+
 
 BuildRequires:  gcc
-BuildRequires:  ruby(release)
-BuildRequires:  ruby-devel
+BuildRequires:	ruby(release)
+BuildRequires:	ruby-devel
 BuildRequires:  rubygems-devel
 BuildRequires:  rubygem(rake)
-BuildRequires:  rubygem(bigdecimal)
-BuildRequires:  rubygem(test-unit-ruby-core)
-BuildRequires:  rubygem(test-unit)
+BuildRequires:	rubygem(bigdecimal)
+BuildRequires:	rubygem(test-unit)
 
 Obsoletes:	rubygem-%{gem_name}-gui < %{version}
 Obsoletes:	ruby-%{gem_name}-gui < %{version}
@@ -47,21 +44,44 @@ Requires:	%{name} = %{version}-%{release}
 This package contains documentation for %{name}.
 
 %prep
-%global	version	%gem_version
+%setup -q -c -T
 
-%setup -q -n %{gem_name}-%{gem_version} -a 1
-mv ./%{gem_name}-%{version}/test .
-mv ../%{gem_name}-%{version}.gemspec .
+# Gem repack
+TOPDIR=$(pwd)
+mkdir tmpunpackdir
+pushd tmpunpackdir
+
+gem unpack %{SOURCE0}
+cd %{gem_name}-%{version}
+
+(
+pushd ext/json/ext/
+%patch1 -p3
+popd
+)
 
 # Change cflags to honor Fedora compiler flags correctly
 find . -name extconf.rb | xargs sed -i -e 's|-O3|-O2|' -e 's|-O0|-O2|'
 
+gem specification -l --ruby %{SOURCE0} > %{gem_name}.gemspec
+gem build %{gem_name}.gemspec
+mv %{gem_name}-%{version}.gem $TOPDIR
+
+popd
+rm -rf tmpunpackdir
+
+
 %build
-gem build %{gem_name}-%{version}.gemspec
 %gem_install
 
 find . -name \*gem -exec chmod 0644 {} \;
 
+# compile again
+find . -name extconf.rb | while read f
+do
+	make -C $(dirname $f) clean all install
+done
+
 # remove pure
 rm -fr .%{gem_instdir}/lib/json/pure*
 
@@ -82,198 +102,52 @@ find $RPM_BUILD_ROOT%{gem_instdir} -name \*.rb -print0 | \
 	xargs --null chmod 0644
 
 # We don't need those files anymore.
-pushd $RPM_BUILD_ROOT%{gem_instdir}
-rm -rf \
-	%{gem_name}.gemspec \
-	Gemfile \
-	ext \
-	java \
-	lib/json/truffle_ruby/ \
-	test \
-	%{nil}
-popd
+rm -rf $RPM_BUILD_ROOT%{gem_instdir}/ext
+rm -rf $RPM_BUILD_ROOT%{gem_instdir}/install.rb
+rm -rf $RPM_BUILD_ROOT%{gem_instdir}/{.require_paths,.gitignore,.travis.yml}
+rm -rf $RPM_BUILD_ROOT%{gem_instdir}/lib/json/ext/
+rm -rf $RPM_BUILD_ROOT%{gem_instdir}/diagrams
+rm -rf $RPM_BUILD_ROOT%{gem_docdir}/rdoc/classes/.src
+rm -rf $RPM_BUILD_ROOT%{gem_docdir}/rdoc/classes/.html
+
+rm -rf $RPM_BUILD_ROOT%{gem_instdir}/java/
 
 %check
-rm -rf .%{gem_instdir}/test
-cp -a ./test .%{gem_instdir}/
-
 pushd .%{gem_instdir}
-ruby -Ilib:test:test/json:$RPM_BUILD_ROOT%{gem_extdir_mri}:. \
-	-e "gem 'test-unit'; require 'test_helper' ; Dir.glob('test/json/*_test.rb').sort.each {|f| require f}"
+ruby -Ilib:$RPM_BUILD_ROOT%{gem_extdir_mri}:. \
+	-e "gem 'test-unit'; Dir.glob('tests/test_*.rb').sort.each {|f| require f}"
 popd
 
 
 %files
+%doc %{gem_instdir}/[A-Z]*
 %dir %{gem_instdir}
 %dir %{gem_libdir}
 %dir %{gem_libdir}/%{gem_name}
-
-%license %{gem_instdir}/BSDL
-%license %{gem_instdir}/COPYING
-%license %{gem_instdir}/LEGAL
-%doc %{gem_instdir}/CHANGES.md
-%doc %{gem_instdir}/README.md
-
+%{gem_instdir}/tools/
 %{gem_libdir}/%{gem_name}.rb
 %{gem_libdir}/%{gem_name}/add
 %{gem_libdir}/%{gem_name}/common.rb
 %{gem_libdir}/%{gem_name}/ext.rb
-%dir	%{gem_libdir}/%{gem_name}/ext
-%dir	%{gem_libdir}/%{gem_name}/ext/generator/
-%{gem_libdir}/%{gem_name}/ext/generator/*.rb
 %{gem_libdir}/%{gem_name}/version.rb
 %{gem_libdir}/%{gem_name}/generic_object.rb
-
 %{ruby_libdir}/json*
 %{ruby_libarchdir}/json*
 %{gem_extdir_mri}/
 %{gem_spec}
-
 %exclude %{gem_cache}
+%exclude %{gem_instdir}/Rakefile
 
 %files      doc
+%{gem_instdir}/references/
+%{gem_instdir}/*gemspec
 %{gem_docdir}/
+%exclude %{gem_instdir}/tests
 
 
 %changelog
-* Fri Jan 09 2026 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.18.0-1
-- 2.18.0
-
-* Tue Oct 07 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.15.1-1
-- 2.15.1
-
-* Thu Sep 25 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.15.0-1
-- 2.15.0
-
-* Thu Jul 31 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.13.2-1
-- 2.13.2
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.12.2-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Tue May 27 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.12.2-1
-- 2.12.2
-
-* Fri May 16 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.12.0-1
-- 2.12.0
-
-* Tue Apr 29 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.11.3-1
-- 2.11.3
-
-* Wed Mar 12 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.10.2-1
-- 2.10.2
-
-* Tue Feb 11 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.10.1-1
-- 2.10.1
-
-* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 2.9.1-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Tue Jan 07 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.9.1-2
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4
-
-* Thu Dec 19 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.9.1-1
-- 2.9.1
-
-* Thu Dec 05 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.9.0-1
-- 2.9.0
-
-* Thu Nov 07 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.8.1-1
-- 2.8.1
-
-* Sat Nov 02 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.8.0~alpha1-14
-- 2.8.0 alpha1 (e660b61)
-
-* Fri Nov 01 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.5-201
-- Apply upstream patch for JSON.generate behavior, restoring activesupport json
-  usage
-
-* Wed Oct 30 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.5-200
-- 2.7.5
-
-* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.2-201
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Thu Apr 04 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.2-200
-- 2.7.2
-
-* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-203
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Mon Jan 22 2024 Fedora Release Engineering <releng@fedoraproject.org> - 2.7.1-202
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Wed Jan 03 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.1-201
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3
-
-* Tue Dec  5 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.1-200
-- 2.7.1
-
-* Sun Dec  3 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.0-201
-- Backport upstream patch for JSON.dump regression for hash
-
-* Fri Dec  1 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.7.0-200
-- 2.7.0
-
-* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.3-204
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Fri Apr 21 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.6.3-203
-- SPDX migration
-
-* Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.3-202
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
-
-* Tue Jan 03 2023 Vít Ondruch <vondruch@redhat.com> - 2.6.3-201
-- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_3.2
-
-* Mon Dec  5 2022 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.6.3-200
-- 2.6.3
-
-* Wed Oct  5 2022 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.6.2-202
-- Remove no longer needed recompilation
-
-* Sat Jul 23 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.2-201
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
-
-* Wed May 18 2022 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.6.2-200
-- 2.6.2
-
-* Wed Jan 26 2022 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.6.1-202
-- F-36: rebuild against ruby31
-
-* Fri Jan 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.6.1-201
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Sun Oct 24 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.6.1-200
-- 2.6.1
-
-* Fri Oct 22 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.6.0-200
-- 2.6.0
-
-* Fri Jul 23 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.1-202
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Wed Jan 27 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.5.1-201
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Wed Jan  6 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.5.1-200
-- 2.5.1
-
-* Wed Jul 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.1-201
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Thu Jul  2 2020 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.3.1-200
-- 2.3.1
-
-* Tue Apr 14 2020 Vít Ondruch <vondruch@redhat.com> - 2.3.0-202
-- Avoid unexpected JRuby dependency.
-
-* Thu Jan 30 2020 Fedora Release Engineering <releng@fedoraproject.org> - 2.3.0-201
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Fri Jan 17 2020 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.3.0-200
-- 2.3.0
+* Sat Apr 25 2020 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.2.0-202
+- Backport fix for CVE-2020-10663 from 2.3.0 (bug 1827500)
 
 * Fri Jul 26 2019 Fedora Release Engineering <releng@fedoraproject.org> - 2.2.0-201
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild

sources

@@ -1,2 +1 @@
-SHA512 (json-2.18.0.gem) = 02b25232a78f0da5bab6db01771385bb0bcefbd6f182314474ca23b61af6a2ec0a66b160ec7a9a3d6c75ccd3a57da08897400fe2673f5cca6a650e133029b884
-SHA512 (rubygem-json-2.18.0-missing-files.tar.gz) = 73453c9e4312ede95f5a3a794cf86f8d138be5425e40e410326fab3592c22710837e5e2c118c4e947466042e6d300a0bd7cb652a3325bb3b9e617705356411da
+SHA512 (json-2.2.0.gem) = 855d5cbeb6e62a7deb009ad454944430c0370cc98c53a1126d8ca3cac4b11a191bfb2ded84a957d4caa0f59cc9b6308e320a58569bddba8d6984078ea34703f2