Bacckport upstream patch for CVE-2020-26298 (bug 1915370)

.gitignore

@@ -1,2 +1,2 @@
-/redcarpet-*gem
-/redcarpet-*-test-missing-files.tar.gz
+/redcarpet-2.1.1.gem
+/redcarpet-3.3.2.gem

redcarpet-3.3.2-CVE-2020-26298.patch

@@ -0,0 +1,56 @@
+From a699c82292b17c8e6a62e1914d5eccc252272793 Mon Sep 17 00:00:00 2001
+From: Robin Dupret <robin.dupret@hey.com>
+Date: Tue, 15 Dec 2020 20:57:32 +0100
+Subject: [PATCH] Fix a security issue using `:quote` with `:escape_html`
+
+Reported by @johan-smits.
+---
+ CHANGELOG.md          |  7 +++++++
+ ext/redcarpet/html.c  |  9 ++++++++-
+ lib/redcarpet.rb      |  2 +-
+ redcarpet.gemspec     |  4 ++--
+ test/markdown_test.rb | 10 ++++++++++
+ 5 files changed, 28 insertions(+), 4 deletions(-)
+
+diff --git a/ext/redcarpet/html.c b/ext/redcarpet/html.c
+index 805ddd8e..785f780f 100644
+--- a/ext/redcarpet/html.c
++++ b/ext/redcarpet/html.c
+@@ -255,8 +255,15 @@ rndr_quote(struct buf *ob, const struct buf *text, void *opaque)
+ 	if (!text || !text->size)
+ 		return 0;
+ 
++	struct html_renderopt *options = opaque;
++
+ 	BUFPUTSL(ob, "<q>");
+-	bufput(ob, text->data, text->size);
++
++	if (options->flags & HTML_ESCAPE)
++		escape_html(ob, text->data, text->size);
++	else
++		bufput(ob, text->data, text->size);
++
+ 	BUFPUTSL(ob, "</q>");
+ 
+ 	return 1;
+diff --git a/test/markdown_test.rb b/test/markdown_test.rb
+index 4347be9b..68de1255 100644
+--- a/test/markdown_test.rb
++++ b/test/markdown_test.rb
+@@ -220,6 +220,16 @@ def test_quote_flag_works
+     assert output.include? '<q>quote</q>'
+   end
+ 
++  def test_quote_flag_honors_escape_html
++    text = 'We are not "<svg/onload=pwned>"'
++
++    output_enabled  = render(text, with: [:quote, :escape_html])
++    output_disabled = render(text, with: [:quote])
++
++    assert_equal "<p>We are not <q>&lt;svg/onload=pwned&gt;</q></p>\n", output_enabled
++    assert_equal "<p>We are not <q><svg/onload=pwned></q></p>\n", output_disabled
++  end
++
+   def test_that_fenced_flag_works
+     text = <<fenced
+ This is a simple test

redcarpet-create-missing-test-files.sh

@@ -1,35 +0,0 @@
-#!/bin/bash
-
-usage() {
-	echo "$0 <VERSION>"
-}
-
-set -e
-set -x
-
-if [ $# -lt 1 ] ; then
-	usage
-	exit 1
-fi
-
-VERSION=$1
-
-GEMNAME=redcarpet
-TMPDIR=$(mktemp -d /var/tmp/${GEMNAME}-XXXXXX)
-CURDIR=$(pwd)
-GITTOPDIR=${GEMNAME}-${VERSION}
-
-pushd $TMPDIR
-
-git clone http://github.com/vmg/${GEMNAME} ${GITTOPDIR}
-cd ${GEMNAME}-$VERSION
-
-git checkout -b fedora-$VERSION v$VERSION || true
-cd ..
-
-tar czf $CURDIR/${GEMNAME}-${VERSION}-test-missing-files.tar.gz \
-	${GITTOPDIR}/test/ \
-
-popd
-rm -rf $TMPDIR
-

rubygem-redcarpet.spec

@@ -1,17 +1,22 @@
 %global gem_name redcarpet
 
 Name:		rubygem-%{gem_name}
-Version:	3.6.1
-Release:	3%{?dist}
+Version:	3.3.2
+Release:	26%{?dist}
 
 Summary:	A fast, safe and extensible Markdown to (X)HTML parser
-# SPDX confirmed
-License:	MIT
+# https://github.com/vmg/redcarpet/issues/502
+License:	MIT and ISC
 URL:		http://github.com/vmg/redcarpet
 Source0:	https://rubygems.org/gems/%{gem_name}-%{version}.gem
-Source1:	%{gem_name}-%{version}-test-missing-files.tar.gz
-# Source1 is created by $ bash %%SOURCE2 %%version
-Source2:	%{gem_name}-create-missing-test-files.sh
+# https://github.com/advisories/GHSA-q3wr-qw3g-3p4h
+# https://github.com/vmg/redcarpet/commit/a699c82292b17c8e6a62e1914d5eccc252272793
+# https://nvd.nist.gov/vuln/detail/CVE-2020-26298
+# Fix a security issue using :quote with :escape_html
+# Fixed in 3.5.1
+# A bit modified for 3.3.2
+# Note that 14942b4f5ef8dbaeeff8d9212f098391d7c1fbdc does chomp, reverting this
+Patch0:	%{gem_name}-3.3.2-CVE-2020-26298.patch
 
 BuildRequires:	gcc
 BuildRequires:	ruby(release)
@@ -31,11 +36,11 @@ BuildArch:	noarch
 Documentation for %{name}.
 
 %prep
-%setup -q -n %{gem_name}-%{version} -b1
-cp -p ../%{gem_name}-%{version}.gemspec .
+%setup -q -n %{gem_name}-%{version}
+%patch -P0 -p1
 
 %build
-gem build ./%{gem_name}-%{version}.gemspec
+gem build ../%{gem_name}-%{version}.gemspec
 %gem_install
 
 # https://github.com/vmg/redcarpet/pull/503
@@ -67,8 +72,6 @@ popd
 rm -f %{buildroot}%{gem_cache}
 
 %check
-cp -a test/ .%{gem_instdir}/
-
 pushd .%{gem_instdir}
 env \
 	RUBYOPT=-Ilib:$(dirs +1)%{gem_extdir_mri}:test \
@@ -90,41 +93,11 @@ popd
 
 %files doc
 %doc %{gem_docdir}
-%{gem_instdir}/CHANGELOG.md
-%{gem_instdir}/CONTRIBUTING.md
+
 
 %changelog
-* Thu Jan 08 2026 Vít Ondruch <vondruch@redhat.com> - 3.6.1-3
-- Rebuilt for https://fedoraproject.org/wiki/Changes/Ruby_4.0
-
-* Fri Jul 25 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.1-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild
-
-* Thu Feb 27 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 3.6.1-1
-- 3.6.1
-
-* Sat Jan 18 2025 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.0-8
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild
-
-* Wed Jan 08 2025 Mamoru TASAKA <mtasaka@fedoraproject.org> - 3.6.0-7
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.4
-
-* Fri Jul 19 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.0-6
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild
-
-* Fri Jan 26 2024 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.0-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
-
-* Wed Jan 03 2024 Mamoru TASAKA <mtasaka@fedoraproject.org> - 3.6.0-4
-- Rebuild for https://fedoraproject.org/wiki/Changes/Ruby_3.3
-
-* Fri Jul 21 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.6.0-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild
-
-* Sun Apr 30 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 3.6.0-2
-- 3.6.0
-- License changed to MIT (SPDX confimred)
-- CVE-2020-26298 is fixed in this version
+* Sun Apr 30 2023 Mamoru TASAKA <mtasaka@fedoraproject.org> - 3.3.2-26
+- Bacckport upstream patch for CVE-2020-26298 (bug 1915370)
 
 * Fri Jan 20 2023 Fedora Release Engineering <releng@fedoraproject.org> - 3.3.2-25
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild

sources

@@ -1,2 +1 @@
-SHA512 (redcarpet-3.6.1.gem) = 220452e147507604394ff5f3f2747cfc17da1e467bd59a54ed47ec46d2ffdaa1f505eb2a1c62723639d20f674e5e84014d55cf1b5d55b65c7ddee2d363a03812
-SHA512 (redcarpet-3.6.1-test-missing-files.tar.gz) = 1af8292c4289092b8adf2252e0586d7ec70120058690072087a6bf942ab1d10a25062078df506a45a9d45fe3075ec7cff8a489aa8f06c6b8fb2d1bb51ceba441
+048b42d499b37c6dd02f2e438758f9b0  redcarpet-3.3.2.gem