diff --git a/.gitignore b/.gitignore index 5778047..89ae688 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/redcarpet-2.1.1.gem -/redcarpet-3.3.2.gem +/redcarpet-*gem +/redcarpet-*-test-missing-files.tar.gz diff --git a/redcarpet-3.3.2-CVE-2020-26298.patch b/redcarpet-3.3.2-CVE-2020-26298.patch deleted file mode 100644 index a497676..0000000 --- a/redcarpet-3.3.2-CVE-2020-26298.patch +++ /dev/null @@ -1,56 +0,0 @@ -From a699c82292b17c8e6a62e1914d5eccc252272793 Mon Sep 17 00:00:00 2001 -From: Robin Dupret -Date: Tue, 15 Dec 2020 20:57:32 +0100 -Subject: [PATCH] Fix a security issue using `:quote` with `:escape_html` - -Reported by @johan-smits. ---- - CHANGELOG.md | 7 +++++++ - ext/redcarpet/html.c | 9 ++++++++- - lib/redcarpet.rb | 2 +- - redcarpet.gemspec | 4 ++-- - test/markdown_test.rb | 10 ++++++++++ - 5 files changed, 28 insertions(+), 4 deletions(-) - -diff --git a/ext/redcarpet/html.c b/ext/redcarpet/html.c -index 805ddd8e..785f780f 100644 ---- a/ext/redcarpet/html.c -+++ b/ext/redcarpet/html.c -@@ -255,8 +255,15 @@ rndr_quote(struct buf *ob, const struct buf *text, void *opaque) - if (!text || !text->size) - return 0; - -+ struct html_renderopt *options = opaque; -+ - BUFPUTSL(ob, ""); -- bufput(ob, text->data, text->size); -+ -+ if (options->flags & HTML_ESCAPE) -+ escape_html(ob, text->data, text->size); -+ else -+ bufput(ob, text->data, text->size); -+ - BUFPUTSL(ob, ""); - - return 1; -diff --git a/test/markdown_test.rb b/test/markdown_test.rb -index 4347be9b..68de1255 100644 ---- a/test/markdown_test.rb -+++ b/test/markdown_test.rb -@@ -220,6 +220,16 @@ def test_quote_flag_works - assert output.include? 'quote' - end - -+ def test_quote_flag_honors_escape_html -+ text = 'We are not ""' -+ -+ output_enabled = render(text, with: [:quote, :escape_html]) -+ output_disabled = render(text, with: [:quote]) -+ -+ assert_equal "

We are not <svg/onload=pwned>

\n", output_enabled -+ assert_equal "

We are not

\n", output_disabled -+ end -+ - def test_that_fenced_flag_works - text = <" +} + +set -e +set -x + +if [ $# -lt 1 ] ; then + usage + exit 1 +fi + +VERSION=$1 + +GEMNAME=redcarpet +TMPDIR=$(mktemp -d /var/tmp/${GEMNAME}-XXXXXX) +CURDIR=$(pwd) +GITTOPDIR=${GEMNAME}-${VERSION} + +pushd $TMPDIR + +git clone http://github.com/vmg/${GEMNAME} ${GITTOPDIR} +cd ${GEMNAME}-$VERSION + +git checkout -b fedora-$VERSION v$VERSION || true +cd .. + +tar czf $CURDIR/${GEMNAME}-${VERSION}-test-missing-files.tar.gz \ + ${GITTOPDIR}/test/ \ + +popd +rm -rf $TMPDIR + diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index fcfa04c..23037f3 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -1,22 +1,17 @@ %global gem_name redcarpet Name: rubygem-%{gem_name} -Version: 3.3.2 -Release: 26%{?dist} +Version: 3.6.1 +Release: 3%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser -# https://github.com/vmg/redcarpet/issues/502 -License: MIT and ISC +# SPDX confirmed +License: MIT URL: http://github.com/vmg/redcarpet Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem -# https://github.com/advisories/GHSA-q3wr-qw3g-3p4h -# https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793 -# https://nvd.nist.gov/vuln/detail/CVE-2020-26298 -# Fix a security issue using :quote with :escape_html -# Fixed in 3.5.1 -# A bit modified for 3.3.2 -# Note that 14942b4f5ef8dbaeeff8d9212f098391d7c1fbdc does chomp, reverting this -Patch0: %{gem_name}-3.3.2-CVE-2020-26298.patch +Source1: %{gem_name}-%{version}-test-missing-files.tar.gz +# Source1 is created by $ bash %%SOURCE2 %%version +Source2: %{gem_name}-create-missing-test-files.sh BuildRequires: gcc BuildRequires: ruby(release) @@ -36,11 +31,11 @@ BuildArch: noarch Documentation for %{name}. %prep -%setup -q -n %{gem_name}-%{version} -%patch -P0 -p1 +%setup -q -n %{gem_name}-%{version} -b1 +cp -p ../%{gem_name}-%{version}.gemspec . %build -gem build ../%{gem_name}-%{version}.gemspec +gem build ./%{gem_name}-%{version}.gemspec %gem_install # https://github.com/vmg/redcarpet/pull/503 @@ -72,6 +67,8 @@ popd rm -f %{buildroot}%{gem_cache} %check +cp -a test/ .%{gem_instdir}/ + pushd .%{gem_instdir} env \ RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test \ @@ -93,11 +90,41 @@ popd %files doc %doc %{gem_docdir} - +%{gem_instdir}/CHANGELOG.md +%{gem_instdir}/CONTRIBUTING.md %changelog -* Sun Apr 30 2023 Mamoru TASAKA - 3.3.2-26 -- Bacckport upstream patch for CVE-2020-26298 (bug 1915370) +* Thu Jan 08 2026 Vít Ondruch - 3.6.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_4.0 + +* Fri Jul 25 2025 Fedora Release Engineering - 3.6.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Thu Feb 27 2025 Mamoru TASAKA - 3.6.1-1 +- 3.6.1 + +* Sat Jan 18 2025 Fedora Release Engineering - 3.6.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Wed Jan 08 2025 Mamoru TASAKA - 3.6.0-7 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 + +* Fri Jul 19 2024 Fedora Release Engineering - 3.6.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Fri Jan 26 2024 Fedora Release Engineering - 3.6.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Wed Jan 03 2024 Mamoru TASAKA - 3.6.0-4 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 + +* Fri Jul 21 2023 Fedora Release Engineering - 3.6.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Sun Apr 30 2023 Mamoru TASAKA - 3.6.0-2 +- 3.6.0 +- License changed to MIT (SPDX confimred) +- CVE-2020-26298 is fixed in this version * Fri Jan 20 2023 Fedora Release Engineering - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 98561bb..34f4212 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -048b42d499b37c6dd02f2e438758f9b0 redcarpet-3.3.2.gem +SHA512 (redcarpet-3.6.1.gem) = 220452e147507604394ff5f3f2747cfc17da1e467bd59a54ed47ec46d2ffdaa1f505eb2a1c62723639d20f674e5e84014d55cf1b5d55b65c7ddee2d363a03812 +SHA512 (redcarpet-3.6.1-test-missing-files.tar.gz) = 1af8292c4289092b8adf2252e0586d7ec70120058690072087a6bf942ab1d10a25062078df506a45a9d45fe3075ec7cff8a489aa8f06c6b8fb2d1bb51ceba441