From 9c9c219df775f723e4db7270236718bd3abd3e80 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Sun, 30 Apr 2023 14:53:41 +0900 Subject: [PATCH 01/13] 3.6.0 License changed to MIT (SPDX confimred) --- .gitignore | 4 ++-- rubygem-redcarpet.spec | 25 ++++++++++++++++++------- sources | 3 ++- 3 files changed, 22 insertions(+), 10 deletions(-) diff --git a/.gitignore b/.gitignore index 5778047..89ae688 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/redcarpet-2.1.1.gem -/redcarpet-3.3.2.gem +/redcarpet-*gem +/redcarpet-*-test-missing-files.tar.gz diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 8b4ab30..1d0fad1 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -1,14 +1,17 @@ %global gem_name redcarpet Name: rubygem-%{gem_name} -Version: 3.3.2 -Release: 25%{?dist} +Version: 3.6.0 +Release: 1%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser -# https://github.com/vmg/redcarpet/issues/502 -License: MIT and ISC +# SPDX confirmed +License: MIT URL: http://github.com/vmg/redcarpet Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem +Source1: %{gem_name}-%{version}-test-missing-files.tar.gz +# Source1 is created by $ bash %%SOURCE2 %%version +Source2: %{gem_name}-create-missing-test-files.sh BuildRequires: gcc BuildRequires: ruby(release) @@ -28,10 +31,11 @@ BuildArch: noarch Documentation for %{name}. %prep -%setup -q -n %{gem_name}-%{version} +%setup -q -n %{gem_name}-%{version} -b1 +cp -p ../%{gem_name}-%{version}.gemspec . %build -gem build ../%{gem_name}-%{version}.gemspec +gem build ./%{gem_name}-%{version}.gemspec %gem_install # https://github.com/vmg/redcarpet/pull/503 @@ -63,6 +67,8 @@ popd rm -f %{buildroot}%{gem_cache} %check +cp -a test/ .%{gem_instdir}/ + pushd .%{gem_instdir} env \ RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test \ @@ -84,9 +90,14 @@ popd %files doc %doc %{gem_docdir} - +%{gem_instdir}/CHANGELOG.md +%{gem_instdir}/CONTRIBUTING.md %changelog +* Sun Apr 30 2023 Mamoru TASAKA - 3.6.0-1 +- 3.6.0 +- License changed to MIT (SPDX confimred) + * Fri Jan 20 2023 Fedora Release Engineering - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index 98561bb..86c6290 100644 --- a/sources +++ b/sources @@ -1 +1,2 @@ -048b42d499b37c6dd02f2e438758f9b0 redcarpet-3.3.2.gem +SHA512 (redcarpet-3.6.0.gem) = 795d4d252903ef6dd51febb18fa5665f599e199a07c0d60eeee60bea3d001c02d926f3b6802ac339de6b0f9efff30081471397256c5dcb6443ec1f04fd4e48f9 +SHA512 (redcarpet-3.6.0-test-missing-files.tar.gz) = 231f14865f026ef1b9733a393e774d646b3e91f520b36765f93716700d090745f8e4fa4ee66eb24c35feb943e78f1c744a1c0534039090be623bf9ddd6b2145e From 666a15fa954e7a09364c0164444956646407599c Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Sun, 30 Apr 2023 14:54:08 +0900 Subject: [PATCH 02/13] add missing script --- redcarpet-create-missing-test-files.sh | 35 ++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 redcarpet-create-missing-test-files.sh diff --git a/redcarpet-create-missing-test-files.sh b/redcarpet-create-missing-test-files.sh new file mode 100644 index 0000000..8bab3c3 --- /dev/null +++ b/redcarpet-create-missing-test-files.sh @@ -0,0 +1,35 @@ +#!/bin/bash + +usage() { + echo "$0 " +} + +set -e +set -x + +if [ $# -lt 1 ] ; then + usage + exit 1 +fi + +VERSION=$1 + +GEMNAME=redcarpet +TMPDIR=$(mktemp -d /tmp/${GEMNAME}-XXXXXX) +CURDIR=$(pwd) +GITTOPDIR=${GEMNAME}-${VERSION} + +pushd $TMPDIR + +git clone http://github.com/vmg/${GEMNAME} ${GITTOPDIR} +cd ${GEMNAME}-$VERSION + +git checkout -b fedora-$VERSION v$VERSION +cd .. + +tar czf $CURDIR/${GEMNAME}-${VERSION}-test-missing-files.tar.gz \ + ${GITTOPDIR}/test/ \ + +popd +rm -rf $TMPDIR + From c6d039accb866622db79b6483b1a41523575473c Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Sun, 30 Apr 2023 19:57:14 +0900 Subject: [PATCH 03/13] mention CVE-2020-26298 is fixed --- rubygem-redcarpet.spec | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 1d0fad1..878e0ca 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,9 +94,10 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog -* Sun Apr 30 2023 Mamoru TASAKA - 3.6.0-1 +* Sun Apr 30 2023 Mamoru TASAKA - 3.6.0-2 - 3.6.0 - License changed to MIT (SPDX confimred) +- CVE-2020-26298 is fixed in this version * Fri Jan 20 2023 Fedora Release Engineering - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From 0bc4066bad9d08a4742ec537dc2df262990308ff Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Sun, 30 Apr 2023 19:59:16 +0900 Subject: [PATCH 04/13] Bacckport upstream patch for CVE-2020-26298 (bug 1915370) --- redcarpet-3.3.2-CVE-2020-26298.patch | 56 ++++++++++++++++++++++++++++ rubygem-redcarpet.spec | 14 ++++++- 2 files changed, 69 insertions(+), 1 deletion(-) create mode 100644 redcarpet-3.3.2-CVE-2020-26298.patch diff --git a/redcarpet-3.3.2-CVE-2020-26298.patch b/redcarpet-3.3.2-CVE-2020-26298.patch new file mode 100644 index 0000000..a497676 --- /dev/null +++ b/redcarpet-3.3.2-CVE-2020-26298.patch @@ -0,0 +1,56 @@ +From a699c82292b17c8e6a62e1914d5eccc252272793 Mon Sep 17 00:00:00 2001 +From: Robin Dupret +Date: Tue, 15 Dec 2020 20:57:32 +0100 +Subject: [PATCH] Fix a security issue using `:quote` with `:escape_html` + +Reported by @johan-smits. +--- + CHANGELOG.md | 7 +++++++ + ext/redcarpet/html.c | 9 ++++++++- + lib/redcarpet.rb | 2 +- + redcarpet.gemspec | 4 ++-- + test/markdown_test.rb | 10 ++++++++++ + 5 files changed, 28 insertions(+), 4 deletions(-) + +diff --git a/ext/redcarpet/html.c b/ext/redcarpet/html.c +index 805ddd8e..785f780f 100644 +--- a/ext/redcarpet/html.c ++++ b/ext/redcarpet/html.c +@@ -255,8 +255,15 @@ rndr_quote(struct buf *ob, const struct buf *text, void *opaque) + if (!text || !text->size) + return 0; + ++ struct html_renderopt *options = opaque; ++ + BUFPUTSL(ob, ""); +- bufput(ob, text->data, text->size); ++ ++ if (options->flags & HTML_ESCAPE) ++ escape_html(ob, text->data, text->size); ++ else ++ bufput(ob, text->data, text->size); ++ + BUFPUTSL(ob, ""); + + return 1; +diff --git a/test/markdown_test.rb b/test/markdown_test.rb +index 4347be9b..68de1255 100644 +--- a/test/markdown_test.rb ++++ b/test/markdown_test.rb +@@ -220,6 +220,16 @@ def test_quote_flag_works + assert output.include? 'quote' + end + ++ def test_quote_flag_honors_escape_html ++ text = 'We are not ""' ++ ++ output_enabled = render(text, with: [:quote, :escape_html]) ++ output_disabled = render(text, with: [:quote]) ++ ++ assert_equal "

We are not <svg/onload=pwned>

\n", output_enabled ++ assert_equal "

We are not

\n", output_disabled ++ end ++ + def test_that_fenced_flag_works + text = < - 3.3.2-26 +- Bacckport upstream patch for CVE-2020-26298 (bug 1915370) + * Fri Jan 20 2023 Fedora Release Engineering - 3.3.2-25 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild From fddd25057884e82d5801104134bb38dd24ab8c5c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 21 Jul 2023 18:16:58 +0000 Subject: [PATCH 05/13] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 878e0ca..9aa877f 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Fri Jul 21 2023 Fedora Release Engineering - 3.6.0-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Sun Apr 30 2023 Mamoru TASAKA - 3.6.0-2 - 3.6.0 - License changed to MIT (SPDX confimred) From 04bc982fb0b2f5561c2789adfee009af9955bc40 Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 4 Jan 2024 00:57:17 +0900 Subject: [PATCH 06/13] Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 9aa877f..1dee365 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 3%{?dist} +Release: 4%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Wed Jan 03 2024 Mamoru TASAKA - 3.6.0-4 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 + * Fri Jul 21 2023 Fedora Release Engineering - 3.6.0-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild From 861f76c99b3091a74e72d4710d4c41523ce20feb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 26 Jan 2024 17:23:15 +0000 Subject: [PATCH 07/13] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 1dee365..bf2903b 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 4%{?dist} +Release: 5%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Fri Jan 26 2024 Fedora Release Engineering - 3.6.0-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Wed Jan 03 2024 Mamoru TASAKA - 3.6.0-4 - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3 From 77b0ae3124e8df33fe0fc9deb7d34607915c22f8 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jul 2024 19:52:07 +0000 Subject: [PATCH 08/13] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index bf2903b..db83b0d 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 5%{?dist} +Release: 6%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Fri Jul 19 2024 Fedora Release Engineering - 3.6.0-6 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Fri Jan 26 2024 Fedora Release Engineering - 3.6.0-5 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From 39714be8132ce4956508675ed439935a34ff875f Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Wed, 8 Jan 2025 16:54:45 +0900 Subject: [PATCH 09/13] Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index db83b0d..7e00096 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 6%{?dist} +Release: 7%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Wed Jan 08 2025 Mamoru TASAKA - 3.6.0-7 +- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 + * Fri Jul 19 2024 Fedora Release Engineering - 3.6.0-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild From 1d6602c7c5427fc5e270145a0b1198dd0ce3d127 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 18 Jan 2025 23:54:46 +0000 Subject: [PATCH 10/13] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 7e00096..de303cd 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.0 -Release: 7%{?dist} +Release: 8%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Sat Jan 18 2025 Fedora Release Engineering - 3.6.0-8 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Wed Jan 08 2025 Mamoru TASAKA - 3.6.0-7 - Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4 From 8fc73002712cee9d0916254ec94e4fa8e0b495cc Mon Sep 17 00:00:00 2001 From: Mamoru TASAKA Date: Thu, 27 Feb 2025 23:20:29 +0900 Subject: [PATCH 11/13] 3.6.1 --- redcarpet-create-missing-test-files.sh | 4 ++-- rubygem-redcarpet.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 6 deletions(-) diff --git a/redcarpet-create-missing-test-files.sh b/redcarpet-create-missing-test-files.sh index 8bab3c3..3c49d3d 100644 --- a/redcarpet-create-missing-test-files.sh +++ b/redcarpet-create-missing-test-files.sh @@ -15,7 +15,7 @@ fi VERSION=$1 GEMNAME=redcarpet -TMPDIR=$(mktemp -d /tmp/${GEMNAME}-XXXXXX) +TMPDIR=$(mktemp -d /var/tmp/${GEMNAME}-XXXXXX) CURDIR=$(pwd) GITTOPDIR=${GEMNAME}-${VERSION} @@ -24,7 +24,7 @@ pushd $TMPDIR git clone http://github.com/vmg/${GEMNAME} ${GITTOPDIR} cd ${GEMNAME}-$VERSION -git checkout -b fedora-$VERSION v$VERSION +git checkout -b fedora-$VERSION v$VERSION || true cd .. tar czf $CURDIR/${GEMNAME}-${VERSION}-test-missing-files.tar.gz \ diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index de303cd..c303085 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -1,8 +1,8 @@ %global gem_name redcarpet Name: rubygem-%{gem_name} -Version: 3.6.0 -Release: 8%{?dist} +Version: 3.6.1 +Release: 1%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Thu Feb 27 2025 Mamoru TASAKA - 3.6.1-1 +- 3.6.1 + * Sat Jan 18 2025 Fedora Release Engineering - 3.6.0-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild diff --git a/sources b/sources index 86c6290..34f4212 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (redcarpet-3.6.0.gem) = 795d4d252903ef6dd51febb18fa5665f599e199a07c0d60eeee60bea3d001c02d926f3b6802ac339de6b0f9efff30081471397256c5dcb6443ec1f04fd4e48f9 -SHA512 (redcarpet-3.6.0-test-missing-files.tar.gz) = 231f14865f026ef1b9733a393e774d646b3e91f520b36765f93716700d090745f8e4fa4ee66eb24c35feb943e78f1c744a1c0534039090be623bf9ddd6b2145e +SHA512 (redcarpet-3.6.1.gem) = 220452e147507604394ff5f3f2747cfc17da1e467bd59a54ed47ec46d2ffdaa1f505eb2a1c62723639d20f674e5e84014d55cf1b5d55b65c7ddee2d363a03812 +SHA512 (redcarpet-3.6.1-test-missing-files.tar.gz) = 1af8292c4289092b8adf2252e0586d7ec70120058690072087a6bf942ab1d10a25062078df506a45a9d45fe3075ec7cff8a489aa8f06c6b8fb2d1bb51ceba441 From 1f297d749b84940c419f79e57d2434e8eb95b4e9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 25 Jul 2025 12:44:17 +0000 Subject: [PATCH 12/13] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index c303085..8fb68b1 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.1 -Release: 1%{?dist} +Release: 2%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Fri Jul 25 2025 Fedora Release Engineering - 3.6.1-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Thu Feb 27 2025 Mamoru TASAKA - 3.6.1-1 - 3.6.1 From 1f3cfd59d37db518a38d71412f4a6104cd4adc5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?V=C3=ADt=20Ondruch?= Date: Thu, 8 Jan 2026 20:54:26 +0100 Subject: [PATCH 13/13] Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_4.0 --- rubygem-redcarpet.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/rubygem-redcarpet.spec b/rubygem-redcarpet.spec index 8fb68b1..23037f3 100644 --- a/rubygem-redcarpet.spec +++ b/rubygem-redcarpet.spec @@ -2,7 +2,7 @@ Name: rubygem-%{gem_name} Version: 3.6.1 -Release: 2%{?dist} +Release: 3%{?dist} Summary: A fast, safe and extensible Markdown to (X)HTML parser # SPDX confirmed @@ -94,6 +94,9 @@ popd %{gem_instdir}/CONTRIBUTING.md %changelog +* Thu Jan 08 2026 Vít Ondruch - 3.6.1-3 +- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_4.0 + * Fri Jul 25 2025 Fedora Release Engineering - 3.6.1-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild