diff --git a/.gitignore b/.gitignore index 89ae688..5778047 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/redcarpet-*gem -/redcarpet-*-test-missing-files.tar.gz +/redcarpet-2.1.1.gem +/redcarpet-3.3.2.gem diff --git a/redcarpet-3.3.2-CVE-2020-26298.patch b/redcarpet-3.3.2-CVE-2020-26298.patch new file mode 100644 index 0000000..a497676 --- /dev/null +++ b/redcarpet-3.3.2-CVE-2020-26298.patch @@ -0,0 +1,56 @@ +From a699c82292b17c8e6a62e1914d5eccc252272793 Mon Sep 17 00:00:00 2001 +From: Robin Dupret +Date: Tue, 15 Dec 2020 20:57:32 +0100 +Subject: [PATCH] Fix a security issue using `:quote` with `:escape_html` + +Reported by @johan-smits. +--- + CHANGELOG.md | 7 +++++++ + ext/redcarpet/html.c | 9 ++++++++- + lib/redcarpet.rb | 2 +- + redcarpet.gemspec | 4 ++-- + test/markdown_test.rb | 10 ++++++++++ + 5 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/ext/redcarpet/html.c b/ext/redcarpet/html.c +index 805ddd8e..785f780f 100644 +--- a/ext/redcarpet/html.c ++++ b/ext/redcarpet/html.c +@@ -255,8 +255,15 @@ rndr_quote(struct buf *ob, const struct buf *text, void *opaque) + if (!text || !text->size) + return 0; + ++ struct html_renderopt *options = opaque; ++ + BUFPUTSL(ob, ""); +- bufput(ob, text->data, text->size); ++ ++ if (options->flags & HTML_ESCAPE) ++ escape_html(ob, text->data, text->size); ++ else ++ bufput(ob, text->data, text->size); ++ + BUFPUTSL(ob, ""); + + return 1; +diff --git a/test/markdown_test.rb b/test/markdown_test.rb +index 4347be9b..68de1255 100644 +--- a/test/markdown_test.rb ++++ b/test/markdown_test.rb +@@ -220,6 +220,16 @@ def test_quote_flag_works + assert output.include? 'quote' + end + ++ def test_quote_flag_honors_escape_html ++ text = 'We are not ""' ++ ++ output_enabled = render(text, with: [:quote, :escape_html]) ++ output_disabled = render(text, with: [:quote]) ++ ++ assert_equal "

We are not <svg/onload=pwned>

\n", output_enabled ++ assert_equal "

We are not

\n", output_disabled ++ end ++ + def test_that_fenced_flag_works + text = <" -} - -set -e -set -x - -if [ $# -lt 1 ] ; then - usage - exit 1 -fi - -VERSION=$1 - -GEMNAME=redcarpet -TMPDIR=$(mktemp -d /var/tmp/${GEMNAME}-XXXXXX) -CURDIR=$(pwd) -GITTOPDIR=${GEMNAME}-${VERSION} - -pushd $TMPDIR - -git clone http://github.com/vmg/${GEMNAME} ${GITTOPDIR} -cd ${GEMNAME}-$VERSION - -git checkout -b fedora-$VERSION v$VERSION || true -cd .. - -tar czf $CURDIR/${GEMNAME}-${VERSION}-test-missing-files.tar.gz \ - ${GITTOPDIR}/test/ \ - -popd -rm -rf $TMPDIR - diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 23037f3..fcfa04c 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -1,17 +1,22 @@ %global gem_name redcarpet Name: rubygem-%{gem_name} -Version: 3.6.1 -Release: 3%{?dist} +Version: 3.3.2 +Release: 26%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser -# SPDX confirmed -License: MIT +# https://github.com/vmg/redcarpet/issues/502 +License: MIT and ISC URL: http://github.com/vmg/redcarpet Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem -Source1: %{gem_name}-%{version}-test-missing-files.tar.gz -# Source1 is created by $ bash %%SOURCE2 %%version -Source2: %{gem_name}-create-missing-test-files.sh +# https://github.com/advisories/GHSA-q3wr-qw3g-3p4h +# https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793 +# https://nvd.nist.gov/vuln/detail/CVE-2020-26298 +# Fix a security issue using :quote with :escape_html +# Fixed in 3.5.1 +# A bit modified for 3.3.2 +# Note that 14942b4f5ef8dbaeeff8d9212f098391d7c1fbdc does chomp, reverting this +Patch0: %{gem_name}-3.3.2-CVE-2020-26298.patch BuildRequires: gcc BuildRequires: ruby(release) @@ -31,11 +36,11 @@ BuildArch: noarch Documentation for %{name}. %prep -%setup -q -n %{gem_name}-%{version} -b1 -cp -p ../%{gem_name}-%{version}.gemspec . +%setup -q -n %{gem_name}-%{version} +%patch -P0 -p1 %build -gem build ./%{gem_name}-%{version}.gemspec +gem build ../%{gem_name}-%{version}.gemspec %gem_install # https://github.com/vmg/redcarpet/pull/503 @@ -67,8 +72,6 @@ popd rm -f %{buildroot}%{gem_cache} %check -cp -a test/ .%{gem_instdir}/ - pushd .%{gem_instdir} env \ RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test \ @@ -90,41 +93,11 @@ popd %files doc %doc %{gem_docdir} -%{gem_instdir}/CHANGELOG.md -%{gem_instdir}/CONTRIBUTING.md + %changelog -* Thu Jan 08 2026 Vít Ondruch - 3.6.1-3 -- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_4.0 - -* Fri Jul 25 2025 Fedora Release Engineering - 3.6.1-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Thu Feb 27 2025 Mamoru TASAKA - 3.6.1-1 -- 3.6.1 - -* Sat Jan 18 2025 Fedora Release Engineering - 3.6.0-8 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Wed Jan 08 2025 Mamoru TASAKA - 3.6.0-7 -- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 - -* Fri Jul 19 2024 Fedora Release Engineering - 3.6.0-6 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Fri Jan 26 2024 Fedora Release Engineering - 3.6.0-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Wed Jan 03 2024 Mamoru TASAKA - 3.6.0-4 -- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 - -* Fri Jul 21 2023 Fedora Release Engineering - 3.6.0-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Sun Apr 30 2023 Mamoru TASAKA - 3.6.0-2 -- 3.6.0 -- License changed to MIT (SPDX confimred) -- CVE-2020-26298 is fixed in this version +* Sun Apr 30 2023 Mamoru TASAKA - 3.3.2-26 +- Bacckport upstream patch for CVE-2020-26298 (bug 1915370) * Fri Jan 20 2023 Fedora Release Engineering - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 34f4212..98561bb 100644 --- a/sources +++ b/sources @@ -1,2 +1 @@ -SHA512 (redcarpet-3.6.1.gem) = 220452e147507604394ff5f3f2747cfc17da1e467bd59a54ed47ec46d2ffdaa1f505eb2a1c62723639d20f674e5e84014d55cf1b5d55b65c7ddee2d363a03812 -SHA512 (redcarpet-3.6.1-test-missing-files.tar.gz) = 1af8292c4289092b8adf2252e0586d7ec70120058690072087a6bf942ab1d10a25062078df506a45a9d45fe3075ec7cff8a489aa8f06c6b8fb2d1bb51ceba441 +048b42d499b37c6dd02f2e438758f9b0 redcarpet-3.3.2.gem