From 8a2d31bf279792941ddbe7e575cfbdd1a1f78cbb Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 25 May 2023 14:31:06 +0900 Subject: [PATCH 1/3] 1.14.5 --- rubygem-nokogiri.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/rubygem-nokogiri.spec b/rubygem-nokogiri.spec index 7e34f2f..610a195 100644 --- a/rubygem-nokogiri.spec +++ b/rubygem-nokogiri.spec @@ -1,4 +1,4 @@ -%global mainver 1.14.4 +%global mainver 1.14.5 #%%global prever .rc4 %global baserelease 1 @@ -271,6 +271,9 @@ popd %doc %{gem_dir}/doc/%{gem_name}-%{mainver}%{?prever}/ %changelog +* Thu May 25 2023 Mamoru TASAKA - 1.14.5-1 +- 1.14.5 + * Fri May 12 2023 Mamoru TASAKA - 1.14.4-1 - 1.14.4 - Note that CVE-2022-34169 is for vendored xalan-j, not affecting Fedora diff --git a/sources b/sources index 89027c8..98e62c0 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (nokogiri-1.14.4.gem) = 875c5dcacf8c3c383686d1cba07dadaf9631096ebd46c09c7c890d21fa802191d9c3d1895960f7cda7f928cda64342b14f21813d5e9f1feb40c7cb0f72792144 -SHA512 (rubygem-nokogiri-1.14.4-full.tar.gz) = 14999df5fb7e2723011f716b3fc16bd74a9c0079f4db5308466385ed17d3f4ee852090ae73125ed0c671809b6b1a0244c9611a30c1bbb310e14f938f4e0270dd +SHA512 (nokogiri-1.14.5.gem) = 9621716da66fc715944ccf85145ddf34ada979e6469d668e4e80ad1d27a5e3d9eaf94b050a7fe24ef9f2ca5a96736c96f26598053980bbccfe9a3459c669fc5e +SHA512 (rubygem-nokogiri-1.14.5-full.tar.gz) = 974ade3cb66bab8f7d3abd1acbe07ad90113c1907b56eecc544825650d60e2d96aae6397c8a8f77e7a31d9a33cea7d7a698340234312c27dd816e2480dc6082a From d2b4fdc72caf3ab3b3726f8c6adf86cf22577e42 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 6 Jul 2023 17:16:36 +0900 Subject: [PATCH 2/3] Backport pr2920: Fix argument typechecking in Text.new and et al --- ...4.5-pr2920-fix-argument-typechecking.patch | 48 +++++++++++++++++++ rubygem-nokogiri.spec | 9 +++- 2 files changed, 56 insertions(+), 1 deletion(-) create mode 100644 nokogiri-1.14.5-pr2920-fix-argument-typechecking.patch diff --git a/nokogiri-1.14.5-pr2920-fix-argument-typechecking.patch b/nokogiri-1.14.5-pr2920-fix-argument-typechecking.patch new file mode 100644 index 0000000..be60447 --- /dev/null +++ b/nokogiri-1.14.5-pr2920-fix-argument-typechecking.patch @@ -0,0 +1,48 @@ +diff -urp '--exclude=*~' nokogiri-1.14.5.orig/ext/nokogiri/xml_cdata.c nokogiri-1.14.5/ext/nokogiri/xml_cdata.c +--- nokogiri-1.14.5.orig/ext/nokogiri/xml_cdata.c 2023-05-24 21:29:21.000000000 +0900 ++++ nokogiri-1.14.5/ext/nokogiri/xml_cdata.c 2023-07-06 17:08:18.578360070 +0900 +@@ -25,6 +25,12 @@ new (int argc, VALUE *argv, VALUE klass) + + rb_scan_args(argc, argv, "2*", &doc, &content, &rest); + ++ if (!rb_obj_is_kind_of(doc, cNokogiriXmlNode)) { ++ rb_raise(rb_eTypeError, ++ "expected first parameter to be a Nokogiri::XML::Document, received %"PRIsVALUE, ++ rb_obj_class(doc)); ++ } ++ + Noko_Node_Get_Struct(doc, xmlDoc, xml_doc); + + if (!NIL_P(content)) { +diff -urp '--exclude=*~' nokogiri-1.14.5.orig/ext/nokogiri/xml_schema.c nokogiri-1.14.5/ext/nokogiri/xml_schema.c +--- nokogiri-1.14.5.orig/ext/nokogiri/xml_schema.c 2023-05-24 21:29:21.000000000 +0900 ++++ nokogiri-1.14.5/ext/nokogiri/xml_schema.c 2023-07-06 17:06:57.466287513 +0900 +@@ -208,6 +208,12 @@ from_document(int argc, VALUE *argv, VAL + + scanned_args = rb_scan_args(argc, argv, "11", &document, &parse_options); + ++ if (!rb_obj_is_kind_of(document, cNokogiriXmlNode)) { ++ rb_raise(rb_eTypeError, ++ "expected parameter to be a Nokogiri::XML::Document, received %"PRIsVALUE, ++ rb_obj_class(document)); ++ } ++ + Noko_Node_Get_Struct(document, xmlDoc, doc); + doc = doc->doc; /* In case someone passes us a node. ugh. */ + +diff -urp '--exclude=*~' nokogiri-1.14.5.orig/ext/nokogiri/xml_text.c nokogiri-1.14.5/ext/nokogiri/xml_text.c +--- nokogiri-1.14.5.orig/ext/nokogiri/xml_text.c 2023-05-24 21:29:21.000000000 +0900 ++++ nokogiri-1.14.5/ext/nokogiri/xml_text.c 2023-07-06 17:08:46.028384621 +0900 +@@ -20,6 +20,12 @@ new (int argc, VALUE *argv, VALUE klass) + + rb_scan_args(argc, argv, "2*", &string, &document, &rest); + ++ if (!rb_obj_is_kind_of(document, cNokogiriXmlNode)) { ++ rb_raise(rb_eTypeError, ++ "expected second parameter to be a Nokogiri::XML::Document, received %"PRIsVALUE, ++ rb_obj_class(document)); ++ } ++ + Noko_Node_Get_Struct(document, xmlDoc, doc); + + node = xmlNewText((xmlChar *)StringValueCStr(string)); diff --git a/rubygem-nokogiri.spec b/rubygem-nokogiri.spec index 610a195..3f9ceae 100644 --- a/rubygem-nokogiri.spec +++ b/rubygem-nokogiri.spec @@ -1,7 +1,7 @@ %global mainver 1.14.5 #%%global prever .rc4 -%global baserelease 1 +%global baserelease 2 %global prerpmver %(echo "%{?prever}" | sed -e 's|\\.||g') %global gem_name nokogiri @@ -29,6 +29,9 @@ Source1: rubygem-%{gem_name}-%{version}%{?prever}-full.tar.gz Source2: nokogiri-create-full-tarball.sh # Shut down libxml2 version unmatching warning Patch0: %{name}-1.11.0.rc4-shutdown-libxml2-warning.patch +# https://github.com/sparklemotion/nokogiri/pull/2920 +# Backport to 1.14.5 +Patch1: %{gem_name}-1.14.5-pr2920-fix-argument-typechecking.patch BuildRequires: ruby(release) BuildRequires: ruby(rubygems) ## @@ -80,6 +83,7 @@ mv ../%{gem_name}-%{version}.gemspec . # patches %patch -P0 -p1 +%patch -P1 -p1 # remove bundled external libraries sed -i \ @@ -271,6 +275,9 @@ popd %doc %{gem_dir}/doc/%{gem_name}-%{mainver}%{?prever}/ %changelog +* Thu Jul 6 2023 Mamoru TASAKA - 1.14.5-2 +- Backport pr2920: Fix argument typechecking in Text.new and et al + * Thu May 25 2023 Mamoru TASAKA - 1.14.5-1 - 1.14.5 From 2b6496bff632482a1bac533d035d4d6c56035d2f Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Sun, 9 Jul 2023 16:31:54 +0900 Subject: [PATCH 3/3] add note --- rubygem-nokogiri.spec | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rubygem-nokogiri.spec b/rubygem-nokogiri.spec index 3f9ceae..5e714b3 100644 --- a/rubygem-nokogiri.spec +++ b/rubygem-nokogiri.spec @@ -32,6 +32,8 @@ Patch0: %{name}-1.11.0.rc4-shutdown-libxml2-warning.patch # https://github.com/sparklemotion/nokogiri/pull/2920 # Backport to 1.14.5 Patch1: %{gem_name}-1.14.5-pr2920-fix-argument-typechecking.patch +# pr2924 not needed for 1.14.x, pr2924 needs pr2807, which is from 1.15.0 +# memsize_node function is not defined in 1.14.x BuildRequires: ruby(release) BuildRequires: ruby(rubygems) ##