From ea8c222187c06f149c193625c1bcffbbcd131968 Mon Sep 17 00:00:00 2001 From: Dennis Gilmore Date: Fri, 19 Jun 2015 04:09:22 +0000 Subject: [PATCH 01/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index f701769..0bff54f 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 12%{?dist} +Release: 13%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -98,6 +98,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Fri Jun 19 2015 Fedora Release Engineering - 1:3.1.3-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + * Fri Feb 13 2015 gil cattaneo 1:3.1.3-12 - introduce license macro From 7df5e8828a1b1426c06794f9624058fb5d1b814b Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 5 Feb 2016 03:36:26 +0000 Subject: [PATCH 02/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index 0bff54f..e1a5079 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 13%{?dist} +Release: 14%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -98,6 +98,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Fri Feb 05 2016 Fedora Release Engineering - 1:3.1.3-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + * Fri Jun 19 2015 Fedora Release Engineering - 1:3.1.3-13 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild From a8a7a1d8eae17746c95e4f538e3214894fc61a7c Mon Sep 17 00:00:00 2001 From: Igor Gnatenko Date: Thu, 12 Jan 2017 17:30:44 +0100 Subject: [PATCH 03/20] Rebuild for readline 7.x Signed-off-by: Igor Gnatenko --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index e1a5079..eb4a037 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 14%{?dist} +Release: 15%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -98,6 +98,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Thu Jan 12 2017 Igor Gnatenko - 1:3.1.3-15 +- Rebuild for readline 7.x + * Fri Feb 05 2016 Fedora Release Engineering - 1:3.1.3-14 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild From 308daf7a186d5e72148ecedea763298f675f2d59 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 11 Feb 2017 17:57:46 +0000 Subject: [PATCH 04/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index eb4a037..98a267f 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 15%{?dist} +Release: 16%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -98,6 +98,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Sat Feb 11 2017 Fedora Release Engineering - 1:3.1.3-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + * Thu Jan 12 2017 Igor Gnatenko - 1:3.1.3-15 - Rebuild for readline 7.x From 6b0ae9a5c0b28054507a2e6c899e740161d06df1 Mon Sep 17 00:00:00 2001 From: Troy Dawson Date: Mon, 12 Jun 2017 09:42:59 -0700 Subject: [PATCH 05/20] Add junit to pom deps Signed-off-by: Mikolaj Izdebski --- xmlrpc.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index 98a267f..74c09de 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 16%{?dist} +Release: 17%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -77,6 +77,9 @@ sed -i 's/\r//' LICENSE.txt %pom_disable_module dist %pom_remove_dep jaxme:jaxmeapi common +# This dep is no longer supplied by ws-commons-util +%pom_add_dep junit:junit:3.8.1:test + %mvn_file :{*} @1 %mvn_package :*-common %{name} @@ -98,6 +101,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Mon Jun 12 2017 Troy Dawson - 1:3.1.3-17 +- Add junit to pom deps. Was originally supplied by ws-commons-util (#1460767) + * Sat Feb 11 2017 Fedora Release Engineering - 1:3.1.3-16 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild From d5ec53e08d8e44e93970c95362b801913f5da16c Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 27 Jul 2017 22:13:55 +0000 Subject: [PATCH 06/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index 74c09de..3fcce3f 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 17%{?dist} +Release: 18%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -101,6 +101,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Thu Jul 27 2017 Fedora Release Engineering - 1:3.1.3-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + * Mon Jun 12 2017 Troy Dawson - 1:3.1.3-17 - Add junit to pom deps. Was originally supplied by ws-commons-util (#1460767) From 5b7a60c7fe55fbb24f6c1cdf35f6ba63237586c9 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 9 Feb 2018 21:47:27 +0000 Subject: [PATCH 07/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index 3fcce3f..e617061 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 18%{?dist} +Release: 19%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -101,6 +101,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Fri Feb 09 2018 Fedora Release Engineering - 1:3.1.3-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + * Thu Jul 27 2017 Fedora Release Engineering - 1:3.1.3-18 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild From ef4efbf91d241070f6f41950f7536049688a3a67 Mon Sep 17 00:00:00 2001 From: Michael Simacek Date: Fri, 18 May 2018 15:39:56 +0200 Subject: [PATCH 08/20] Disallow deserialization of tags by default - Resolves CVE-2016-5003 --- ...erialization-of-ex-serializable-tags.patch | 35 +++++++++++++++++++ xmlrpc.spec | 8 ++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch diff --git a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch new file mode 100644 index 0000000..5018eb6 --- /dev/null +++ b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch @@ -0,0 +1,35 @@ +From 495d6136d9de5c0bbddadffe11b0841c6aafcb34 Mon Sep 17 00:00:00 2001 +From: Michael Simacek +Date: Fri, 18 May 2018 15:22:49 +0200 +Subject: [PATCH] Disallow deserialization of tags + +Can be reenabled by setting JVM property +org.apache.xmlrpc.allowInsecureDeserialization to 1. + +- Resolves CVE-2016-5003 +--- + .../java/org/apache/xmlrpc/parser/SerializableParser.java | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java +index 18f25ac..c8bb7ed 100644 +--- a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java ++++ b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java +@@ -29,6 +29,14 @@ import org.apache.xmlrpc.XmlRpcException; + */ + public class SerializableParser extends ByteArrayParser { + public Object getResult() throws XmlRpcException { ++ if (!"1".equals(System.getProperty("org.apache.xmlrpc.allowInsecureDeserialization"))) { ++ throw new UnsupportedOperationException( ++ "Deserialization of ex:serializable objects is vulnerable to " + ++ "remote execution attacks and is disabled by default. " + ++ "If you are sure the source data is trusted, you can enable " + ++ "it by setting org.apache.xmlrpc.allowInsecureDeserialization " + ++ "JVM property to 1"); ++ } + try { + byte[] res = (byte[]) super.getResult(); + ByteArrayInputStream bais = new ByteArrayInputStream(res); +-- +2.17.0 + diff --git a/xmlrpc.spec b/xmlrpc.spec index e617061..ccad587 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 19%{?dist} +Release: 20%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -12,6 +12,7 @@ Patch0: %{name}-client-addosgimanifest.patch Patch1: %{name}-common-addosgimanifest.patch Patch2: %{name}-javax-methods.patch Patch3: %{name}-server-addosgimanifest.patch +Patch4: %{name}-disallow-deserialization-of-ex-serializable-tags.patch BuildRequires: maven-local BuildRequires: mvn(org.apache:apache:pom:) @@ -72,6 +73,7 @@ popd pushd server %patch3 -b .sav popd +%patch4 -p1 sed -i 's/\r//' LICENSE.txt @@ -101,6 +103,10 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Fri May 18 2018 Michael Simacek - 1:3.1.3-20 +- Disallow deserialization of tags by default +- Resolves CVE-2016-5003 + * Fri Feb 09 2018 Fedora Release Engineering - 1:3.1.3-19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 2db59ec8a8b4d358802e98ce0151af84d7b93752 Mon Sep 17 00:00:00 2001 From: Michael Simacek Date: Wed, 23 May 2018 08:43:48 +0200 Subject: [PATCH 09/20] Disallow loading of external DTD Resolves CVE-2016-5002 --- ...erialization-of-ex-serializable-tags.patch | 2 +- xmlrpc-disallow-loading-external-dtd.patch | 30 +++++++++++++++++++ xmlrpc.spec | 4 +++ 3 files changed, 35 insertions(+), 1 deletion(-) create mode 100644 xmlrpc-disallow-loading-external-dtd.patch diff --git a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch index 5018eb6..53a0a98 100644 --- a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch +++ b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch @@ -1,7 +1,7 @@ From 495d6136d9de5c0bbddadffe11b0841c6aafcb34 Mon Sep 17 00:00:00 2001 From: Michael Simacek Date: Fri, 18 May 2018 15:22:49 +0200 -Subject: [PATCH] Disallow deserialization of tags +Subject: [PATCH 1/2] Disallow deserialization of tags Can be reenabled by setting JVM property org.apache.xmlrpc.allowInsecureDeserialization to 1. diff --git a/xmlrpc-disallow-loading-external-dtd.patch b/xmlrpc-disallow-loading-external-dtd.patch new file mode 100644 index 0000000..f59b9c0 --- /dev/null +++ b/xmlrpc-disallow-loading-external-dtd.patch @@ -0,0 +1,30 @@ +From 338ab231b228bd36afda4ab31db724c6669579b2 Mon Sep 17 00:00:00 2001 +From: Michael Simacek +Date: Tue, 22 May 2018 10:53:28 +0200 +Subject: [PATCH 2/2] Disallow loading external DTD + +--- + .../src/main/java/org/apache/xmlrpc/util/SAXParsers.java | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java +index b1034e7..49ef5de 100644 +--- a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java ++++ b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java +@@ -48,6 +48,13 @@ public class SAXParsers { + } catch (org.xml.sax.SAXException e) { + // Ignore it + } ++ try { ++ spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); ++ } catch (javax.xml.parsers.ParserConfigurationException e) { ++ // Ignore it ++ } catch (org.xml.sax.SAXException e) { ++ // Ignore it ++ } + } + + /** Creates a new instance of {@link XMLReader}. +-- +2.17.0 + diff --git a/xmlrpc.spec b/xmlrpc.spec index ccad587..7b3b456 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -13,6 +13,7 @@ Patch1: %{name}-common-addosgimanifest.patch Patch2: %{name}-javax-methods.patch Patch3: %{name}-server-addosgimanifest.patch Patch4: %{name}-disallow-deserialization-of-ex-serializable-tags.patch +Patch5: %{name}-disallow-loading-external-dtd.patch BuildRequires: maven-local BuildRequires: mvn(org.apache:apache:pom:) @@ -74,6 +75,7 @@ pushd server %patch3 -b .sav popd %patch4 -p1 +%patch5 -p1 sed -i 's/\r//' LICENSE.txt @@ -106,6 +108,8 @@ sed -i 's/\r//' LICENSE.txt * Fri May 18 2018 Michael Simacek - 1:3.1.3-20 - Disallow deserialization of tags by default - Resolves CVE-2016-5003 +- Disallow loading of external DTD +- Resolves CVE-2016-5002 * Fri Feb 09 2018 Fedora Release Engineering - 1:3.1.3-19 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild From 383187a645035d4d1ad39a1eaa8631ed15ea9277 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 14 Jul 2018 09:23:48 +0000 Subject: [PATCH 10/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index 7b3b456..c2f876a 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 20%{?dist} +Release: 21%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -105,6 +105,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Sat Jul 14 2018 Fedora Release Engineering - 1:3.1.3-21 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + * Fri May 18 2018 Michael Simacek - 1:3.1.3-20 - Disallow deserialization of tags by default - Resolves CVE-2016-5003 From 087a3b1d4b506b4408e73ca997b4bf36ce6ff0b0 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sun, 3 Feb 2019 12:33:34 +0000 Subject: [PATCH 11/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index c2f876a..c430286 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 21%{?dist} +Release: 22%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -105,6 +105,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Sun Feb 03 2019 Fedora Release Engineering - 1:3.1.3-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + * Sat Jul 14 2018 Fedora Release Engineering - 1:3.1.3-21 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild From 1fd6b41bcd33afd8523279dc303ea23fd16a5036 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Sat, 27 Jul 2019 04:21:15 +0000 Subject: [PATCH 12/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index c430286..2979844 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 22%{?dist} +Release: 23%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -105,6 +105,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Sat Jul 27 2019 Fedora Release Engineering - 1:3.1.3-23 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + * Sun Feb 03 2019 Fedora Release Engineering - 1:3.1.3-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 0a09e0d088b4815e8190a0eec1a93324750807da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Sun, 13 Oct 2019 21:58:47 +0200 Subject: [PATCH 13/20] Orphaned for 6+ weeks --- .gitignore | 2 - .project | 17 -- changelog-pre3.x.txt | 120 -------- dead.package | 1 + sources | 1 - xmlrpc-client-addosgimanifest.patch | 20 -- xmlrpc-common-addosgimanifest.patch | 19 -- ...erialization-of-ex-serializable-tags.patch | 35 --- xmlrpc-disallow-loading-external-dtd.patch | 30 -- xmlrpc-javax-methods.patch | 264 ------------------ xmlrpc-server-addosgimanifest.patch | 15 - xmlrpc.spec | 181 ------------ 12 files changed, 1 insertion(+), 704 deletions(-) delete mode 100644 .gitignore delete mode 100644 .project delete mode 100644 changelog-pre3.x.txt create mode 100644 dead.package delete mode 100644 sources delete mode 100644 xmlrpc-client-addosgimanifest.patch delete mode 100644 xmlrpc-common-addosgimanifest.patch delete mode 100644 xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch delete mode 100644 xmlrpc-disallow-loading-external-dtd.patch delete mode 100644 xmlrpc-javax-methods.patch delete mode 100644 xmlrpc-server-addosgimanifest.patch delete mode 100644 xmlrpc.spec diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 6de88cd..0000000 --- a/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -xmlrpc-2.0.1-src.tar.gz -/apache-xmlrpc-3.1.3-src.tar.bz2 diff --git a/.project b/.project deleted file mode 100644 index d3cdf74..0000000 --- a/.project +++ /dev/null @@ -1,17 +0,0 @@ - - - xmlrpc - - - - - - org.eclipse.linuxtools.rpm.rpmlint.rpmlintBuilder - - - - - - org.eclipse.linuxtools.rpm.rpmlint.rpmlintNature - - diff --git a/changelog-pre3.x.txt b/changelog-pre3.x.txt deleted file mode 100644 index 9cef632..0000000 --- a/changelog-pre3.x.txt +++ /dev/null @@ -1,120 +0,0 @@ -* Sun Jul 22 2012 Fedora Release Engineering - 0:2.0.1-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Tue Jun 05 2012 Stanislav Ochotnicky - 0:2.0.1-12 -- Migrate to new tomcat-servlet-api - -* Sat Jan 14 2012 Fedora Release Engineering - 0:2.0.1-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Mon Feb 07 2011 Fedora Release Engineering - 0:2.0.1-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Tue Dec 21 2010 Stanislav Ochotnicky - 0:2.0.1-9 -- Require java >= 1:1.6.0 -- Fix classpaths to ensure building of all optional features -- Remove stale patch - -* Thu Dec 16 2010 Stanislav Ochotnicky - 0:2.0.1-8 -- Migrate from old servlet api to new one - -* Thu Dec 9 2010 Stanislav Ochotnicky - 0:2.0.1-7 -- Remove gcj support -- Make jars/javadocs versionless -- Add ws-commons-util Requires -- Use apache-commons-codec -- Drop unneeded patch for jsse - -* Thu Mar 11 2010 Peter Lemenkov - 0:2.0.1-6.6 -- Added missing requires jpackage-utils - -* Mon Jul 27 2009 Fedora Release Engineering - 0:2.0.1-6.5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Thu Feb 26 2009 Fedora Release Engineering - 0:2.0.1-5.5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild - -* Thu Jul 10 2008 Tom "spot" Callaway - 0:2.0.1-4.5 -- drop repotag - -* Thu May 29 2008 Tom "spot" Callaway - 0:2.0.1-4jpp.4 -- fix license tag - -* Tue Feb 19 2008 Fedora Release Engineering - 0:2.0.1-4jpp.3 -- Autorebuild for GCC 4.3 - -* Tue Mar 27 2007 Matt Wringe 0:2.0.1-3jpp.3 -- Spec file clean up for Fedora Extras Review - -* Thu Mar 08 2007 Deepak Bhole 2.0.1-3jpp.2 -- Add javax.net.ssl support to build org.apache.xmlrpc.secure.* -- Minor spec file cleanup - -* Fri Aug 04 2006 Vivek Lakshmanan - 0:2.0.1-3jpp.1 -- Merge with latest from JPP. - -* Sat Jul 22 2006 Jakub Jelinek - 0:2.0.1-1jpp_8.2fc -- Rebuilt - -* Wed Jul 12 2006 Jesse Keating - 0:2.0.1-1jpp_8.1fc -- rebuild - -* Wed Mar 8 2006 Rafael Schloming - 0:2.0.1-1jpp_7fc -- excluded s390 due to eclipse - -* Mon Mar 6 2006 Jeremy Katz - 0:2.0.1-1jpp_6fc -- stop scriptlet spew - -* Fri Feb 24 2006 Igor Foox - 0:2.0.1-1jpp_5fc -- Added post/postun dependency on coreutils. - -* Fri Feb 10 2006 Jesse Keating - 0:2.0.1-1jpp_4fc -- bump again for double-long bug on ppc(64) - -* Tue Feb 07 2006 Jesse Keating - 0:2.0.1-1jpp_3fc -- rebuilt for new gcc4.1 snapshot and glibc changes - -* Wed Jan 25 2006 Igor Foox 0:2.0.1-1jpp_2fc -- ExcludeArch s390x and ppc64 - -* Wed Jan 18 2006 Andrew Overholt 0:2.0.1-1jpp_2fc -- Comment out JPackage Distribution and Vendor tags - -* Wed Jan 18 2006 Jesse Keating 0:2.0.1-1jpp_2fc -- bump for test - -* Wed Jan 18 2006 Igor Foox 0:2.0.1-1jpp_1fc -- Update to version 2.0.1 -- Natively compile - -* Thu Aug 26 2004 Ralph Apel 0:1.2-0.b1.3jpp -- Build with ant-1.6.2 - -* Thu Apr 29 2004 David Walluck 0:1.2-0.b1.2jpp -- add jar symlinks -- remove %%buildroot in %%install - -* Tue May 06 2003 David Walluck 0:1.2-0.b1.1jpp -- 1.2-b1 -- update for JPackage 1.5 - -* Mon Mar 18 2002 Guillaume Rousse 1.1-1jpp -- 1.1 -- generic servlet support -- used source release -- dropped patch -- added applet jar - -* Mon Jan 21 2002 Guillaume Rousse 1.0-3jpp -- versioned dir for javadoc -- no dependencies for javadoc package -- dropped jsse package -- adaptation to new servlet3 package -- adaptation to new jsse package -- section macro - -* Fri Dec 7 2001 Guillaume Rousse 1.0-2jpp -- javadoc into javadoc package - -* Sat Nov 3 2001 Guillaume Rousse 1.0-1jpp -- first JPackage release diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..5204a84 --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +Orphaned for 6+ weeks diff --git a/sources b/sources deleted file mode 100644 index f4bbd2c..0000000 --- a/sources +++ /dev/null @@ -1 +0,0 @@ -f7817485fa6a6a500c49ec9515d1f3b9 apache-xmlrpc-3.1.3-src.tar.bz2 diff --git a/xmlrpc-client-addosgimanifest.patch b/xmlrpc-client-addosgimanifest.patch deleted file mode 100644 index 437d78f..0000000 --- a/xmlrpc-client-addosgimanifest.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- pom.xml.sav 2010-02-06 17:44:57.000000000 +0200 -+++ pom.xml 2010-09-29 09:27:06.194857352 +0300 -@@ -48,6 +48,17 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 2 -+ %Bundle-Name -+ plugin -+ org.apache.xmlrpc -+ ${project.version} -+ org.apache.xmlrpc.common -+ org.apache.xmlrpc, org.apache.xmlrpc.client, org.apache.xmlrpc.client.util -+ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers -+ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 -+ dependent -+ %Bundle-Vendor.0 - - - diff --git a/xmlrpc-common-addosgimanifest.patch b/xmlrpc-common-addosgimanifest.patch deleted file mode 100644 index 4d4aeca..0000000 --- a/xmlrpc-common-addosgimanifest.patch +++ /dev/null @@ -1,19 +0,0 @@ ---- pom.xml.sav 2010-02-06 17:44:50.000000000 +0200 -+++ pom.xml 2010-09-29 09:30:38.857857644 +0300 -@@ -48,6 +48,16 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 2 -+ %Bundle-Name -+ plugin -+ org.apache.xmlrpc.common -+ ${project.version} -+ org.apache.xmlrpc, org.apache.xmlrpc.common, org.apache.xmlrpc.jaxb, org.apache.xmlrpc.parser, org.apache.xmlrpc.serializer, org.apache.xmlrpc.util -+ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers -+ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 -+ dependent -+ %Bundle-Vendor.0 - - - diff --git a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch deleted file mode 100644 index 53a0a98..0000000 --- a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 495d6136d9de5c0bbddadffe11b0841c6aafcb34 Mon Sep 17 00:00:00 2001 -From: Michael Simacek -Date: Fri, 18 May 2018 15:22:49 +0200 -Subject: [PATCH 1/2] Disallow deserialization of tags - -Can be reenabled by setting JVM property -org.apache.xmlrpc.allowInsecureDeserialization to 1. - -- Resolves CVE-2016-5003 ---- - .../java/org/apache/xmlrpc/parser/SerializableParser.java | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -index 18f25ac..c8bb7ed 100644 ---- a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -+++ b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -@@ -29,6 +29,14 @@ import org.apache.xmlrpc.XmlRpcException; - */ - public class SerializableParser extends ByteArrayParser { - public Object getResult() throws XmlRpcException { -+ if (!"1".equals(System.getProperty("org.apache.xmlrpc.allowInsecureDeserialization"))) { -+ throw new UnsupportedOperationException( -+ "Deserialization of ex:serializable objects is vulnerable to " + -+ "remote execution attacks and is disabled by default. " + -+ "If you are sure the source data is trusted, you can enable " + -+ "it by setting org.apache.xmlrpc.allowInsecureDeserialization " + -+ "JVM property to 1"); -+ } - try { - byte[] res = (byte[]) super.getResult(); - ByteArrayInputStream bais = new ByteArrayInputStream(res); --- -2.17.0 - diff --git a/xmlrpc-disallow-loading-external-dtd.patch b/xmlrpc-disallow-loading-external-dtd.patch deleted file mode 100644 index f59b9c0..0000000 --- a/xmlrpc-disallow-loading-external-dtd.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 338ab231b228bd36afda4ab31db724c6669579b2 Mon Sep 17 00:00:00 2001 -From: Michael Simacek -Date: Tue, 22 May 2018 10:53:28 +0200 -Subject: [PATCH 2/2] Disallow loading external DTD - ---- - .../src/main/java/org/apache/xmlrpc/util/SAXParsers.java | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java -index b1034e7..49ef5de 100644 ---- a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java -+++ b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java -@@ -48,6 +48,13 @@ public class SAXParsers { - } catch (org.xml.sax.SAXException e) { - // Ignore it - } -+ try { -+ spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); -+ } catch (javax.xml.parsers.ParserConfigurationException e) { -+ // Ignore it -+ } catch (org.xml.sax.SAXException e) { -+ // Ignore it -+ } - } - - /** Creates a new instance of {@link XMLReader}. --- -2.17.0 - diff --git a/xmlrpc-javax-methods.patch b/xmlrpc-javax-methods.patch deleted file mode 100644 index 0c66b6c..0000000 --- a/xmlrpc-javax-methods.patch +++ /dev/null @@ -1,264 +0,0 @@ -From d6834da0b1556bb133a534d31bb94d08f38fa195 Mon Sep 17 00:00:00 2001 -From: Mikolaj Izdebski -Date: Mon, 16 Jun 2014 10:03:35 +0200 -Subject: [PATCH] Use servlet 3.1.0 API - ---- - dist/pom.xml | 2 +- - pom.xml | 4 +- - server/pom.xml | 8 +++- - .../xmlrpc/webserver/HttpServletRequestImpl.java | 54 ++++++++++++++++++++++ - .../xmlrpc/webserver/HttpServletResponseImpl.java | 26 ++++++++++- - .../xmlrpc/webserver/ServletOutputStreamImpl.java | 5 ++ - 6 files changed, 94 insertions(+), 5 deletions(-) - -diff --git a/dist/pom.xml b/dist/pom.xml -index 67aded6..c18c2eb 100644 ---- a/dist/pom.xml -+++ b/dist/pom.xml -@@ -59,7 +59,7 @@ - - - javax.servlet -- servlet-api -+ javax.servlet-api - - - org.apache.xmlrpc -diff --git a/pom.xml b/pom.xml -index 3933da5..70c508e 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -344,8 +344,8 @@ - - - javax.servlet -- servlet-api -- 2.4 -+ javax.servlet-api -+ 3.1.0 - provided - - -diff --git a/server/pom.xml b/server/pom.xml -index 0d09544..01288c8 100644 ---- a/server/pom.xml -+++ b/server/pom.xml -@@ -67,6 +67,12 @@ - - commons-logging - commons-logging -+ -+ -+ javax.servlet -+ servlet-api -+ -+ - - - org.apache.xmlrpc -@@ -81,7 +87,7 @@ - - - javax.servlet -- servlet-api -+ javax.servlet-api - - - commons-httpclient -diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java -index 3dc7e43..19b14a2 100644 ---- a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java -+++ b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java -@@ -31,6 +31,7 @@ import java.net.URLDecoder; - import java.security.Principal; - import java.util.ArrayList; - import java.util.Collections; -+import java.util.Collection; - import java.util.Enumeration; - import java.util.HashMap; - import java.util.Iterator; -@@ -39,10 +40,20 @@ import java.util.Locale; - import java.util.Map; - import java.util.StringTokenizer; - -+import javax.servlet.ReadListener; - import javax.servlet.RequestDispatcher; -+import javax.servlet.ServletException; - import javax.servlet.ServletInputStream; -+import javax.servlet.DispatcherType; -+import javax.servlet.AsyncContext; -+import javax.servlet.ServletContext; -+import javax.servlet.ServletRequest; -+import javax.servlet.ServletResponse; - import javax.servlet.http.Cookie; -+import javax.servlet.http.HttpUpgradeHandler; -+import javax.servlet.http.Part; - import javax.servlet.http.HttpServletRequest; -+import javax.servlet.http.HttpServletResponse; - import javax.servlet.http.HttpSession; - - import org.apache.xmlrpc.common.XmlRpcStreamConfig; -@@ -66,6 +77,7 @@ public class HttpServletRequestImpl implements HttpServletRequest { - private String queryString; - private String httpVersion; - private final Map headers = new HashMap(); -+ private final Map parts = new HashMap(); - private final Map attributes = new HashMap(); - private Map parameters; - private String characterEncoding; -@@ -97,6 +109,18 @@ public class HttpServletRequestImpl implements HttpServletRequest { - } - return c; - } -+ -+ public boolean isFinished() { -+ return contentBytesRemaining == 0; -+ } -+ -+ public boolean isReady() { -+ return true; -+ } -+ -+ public void setReadListener(ReadListener arg0) { -+ throw new IllegalStateException("Not implemented."); -+ } - }; - } - -@@ -227,6 +251,12 @@ public class HttpServletRequestImpl implements HttpServletRequest { - return Collections.enumeration(list); - } - -+ public Part getPart(String name) { throw new IllegalStateException("Not implemented"); } -+ -+ public Collection getParts() { throw new IllegalStateException("Not implemented"); } -+ -+ public boolean authenticate (HttpServletResponse response) { throw new IllegalStateException("Not implemented"); } -+ - public int getIntHeader(String pHeader) { - String s = getHeader(pHeader); - return s == null ? -1 : Integer.parseInt(s); -@@ -242,6 +272,10 @@ public class HttpServletRequestImpl implements HttpServletRequest { - - public String getRemoteUser() { throw new IllegalStateException("Not implemented"); } - -+ public void login(String username, String password) { throw new IllegalStateException("Not implemented"); } -+ -+ public void logout() { throw new IllegalStateException("Not implemented"); } -+ - public String getRequestURI() { return uri; } - - public StringBuffer getRequestURL() { -@@ -280,6 +314,20 @@ public class HttpServletRequestImpl implements HttpServletRequest { - return sb; - } - -+ public AsyncContext getAsyncContext() { throw new IllegalStateException("Not implemented"); } -+ -+ public boolean isAsyncSupported() { return false; } -+ -+ public boolean isAsyncStarted() { return false; } -+ -+ public ServletContext getServletContext() { throw new IllegalStateException("Not implemented"); } -+ -+ public AsyncContext startAsync(ServletRequest req, ServletResponse resp) { throw new IllegalStateException("Not implemented"); } -+ -+ public AsyncContext startAsync() { throw new IllegalStateException("Not implemented"); } -+ -+ public DispatcherType getDispatcherType() { throw new IllegalStateException("Not implemented"); } -+ - public String getRequestedSessionId() { throw new IllegalStateException("Not implemented"); } - - public String getServletPath() { return uri; } -@@ -544,4 +592,10 @@ public class HttpServletRequestImpl implements HttpServletRequest { - } - - protected String getHttpVersion() { return httpVersion; } -+ -+ public long getContentLengthLong() { throw new IllegalStateException("Not implemented."); } -+ -+ public String changeSessionId() { throw new IllegalStateException("Not implemented."); } -+ -+ public HttpUpgradeHandler upgrade(Class arg0) { throw new IllegalStateException("Not implemented."); } - } -diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java -index 6ba7018..5319dcf 100644 ---- a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java -+++ b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java -@@ -29,6 +29,8 @@ import java.util.Iterator; - import java.util.List; - import java.util.Locale; - import java.util.Map; -+import java.util.Collection; -+import java.util.Collections; - import java.util.StringTokenizer; - - import javax.servlet.ServletOutputStream; -@@ -84,7 +86,7 @@ public class HttpServletResponseImpl implements HttpServletResponse { - } - } - -- private String getHeader(String pHeader) { -+ public String getHeader(String pHeader) { - String key = pHeader.toLowerCase(); - Object o = headers.get(key); - if (o == null) { -@@ -101,6 +103,26 @@ public class HttpServletResponseImpl implements HttpServletResponse { - } - } - -+ public Collection getHeaderNames() { -+ return headers.keySet(); -+ } -+ -+ public Collection getHeaders(String pHeader) { -+ String key = pHeader.toLowerCase(); -+ Object o = headers.get(key); -+ List list; -+ if (o instanceof List) { -+ list = (List) o; -+ } else { -+ list = Collections.singletonList(o); -+ } -+ return list; -+ } -+ -+ public int getStatus() { -+ return status; -+ } -+ - public void addIntHeader(String pHeader, int pValue) { - addHeader(pHeader, Integer.toString(pValue)); - } -@@ -465,4 +487,6 @@ public class HttpServletResponseImpl implements HttpServletResponse { - sb.append("\r\n"); - return sb.toString(); - } -+ -+ public void setContentLengthLong(long arg0) { throw new IllegalStateException("Not implemented."); } - } -diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java -index c2a53b1..86dbbb4 100644 ---- a/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java -+++ b/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java -@@ -22,6 +22,7 @@ import java.io.IOException; - import java.io.OutputStream; - - import javax.servlet.ServletOutputStream; -+import javax.servlet.WriteListener; - - - /** Default implementation of a servlet output stream. -@@ -99,4 +100,8 @@ class ServletOutputStreamImpl extends ServletOutputStream { - boolean isCommitted() { - return committed; - } -+ -+ public boolean isReady() { return true; } -+ -+ public void setWriteListener(WriteListener arg0) { throw new IllegalStateException("Not implemented."); } - } --- -1.9.3 - diff --git a/xmlrpc-server-addosgimanifest.patch b/xmlrpc-server-addosgimanifest.patch deleted file mode 100644 index af54e20..0000000 --- a/xmlrpc-server-addosgimanifest.patch +++ /dev/null @@ -1,15 +0,0 @@ ---- pom.xml 2014-07-07 11:24:52.668887604 -0400 -+++ pom.xml.sav 2014-07-07 11:25:06.174916380 -0400 -@@ -48,6 +48,12 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 1 -+ %Bundle-Name -+ org.apache.xmlrpc.server -+ ${project.version} -+ org.apache.xmlrpc.common -+ org.apache.xmlrpc.server,org.apache.xmlrpc.webserver - - - diff --git a/xmlrpc.spec b/xmlrpc.spec deleted file mode 100644 index 2979844..0000000 --- a/xmlrpc.spec +++ /dev/null @@ -1,181 +0,0 @@ -Name: xmlrpc -Version: 3.1.3 -Release: 23%{?dist} -Epoch: 1 -Summary: Java XML-RPC implementation -License: ASL 2.0 -URL: http://ws.apache.org/xmlrpc/ -BuildArch: noarch - -Source0: http://www.apache.org/dist/ws/xmlrpc/sources/apache-xmlrpc-%{version}-src.tar.bz2 -Patch0: %{name}-client-addosgimanifest.patch -Patch1: %{name}-common-addosgimanifest.patch -Patch2: %{name}-javax-methods.patch -Patch3: %{name}-server-addosgimanifest.patch -Patch4: %{name}-disallow-deserialization-of-ex-serializable-tags.patch -Patch5: %{name}-disallow-loading-external-dtd.patch - -BuildRequires: maven-local -BuildRequires: mvn(org.apache:apache:pom:) -BuildRequires: mvn(commons-httpclient:commons-httpclient) -BuildRequires: mvn(commons-logging:commons-logging) -BuildRequires: mvn(javax.servlet:servlet-api) -BuildRequires: mvn(org.apache.ws.commons.util:ws-commons-util) - - -%description -Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol -that uses XML over HTTP to implement remote procedure calls. -Apache XML-RPC was previously known as Helma XML-RPC. If you have code -using the Helma library, all you should have to do is change the import -statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*. - -%package javadoc -Summary: Javadoc for %{name} - -%description javadoc -Javadoc for %{name}. - -%package common -Summary: Common classes for XML-RPC client and server implementations -# Provide xmlrpc is not here because it would be useless due to different jar names -Obsoletes: %{name} < 3.1.3 -Obsoletes: %{name}3-common < 3.1.3-13 -Provides: %{name}3-common = 3.1.3-13 - -%description common -%{summary}. - -%package client -Summary: XML-RPC client implementation -Obsoletes: %{name}3-client < 3.1.3-13 -Provides: %{name}3-client = 3.1.3-13 - -%description client -%{summary}. - -%package server -Summary: XML-RPC server implementation -Obsoletes: %{name}3-server < 3.1.3-13 -Provides: %{name}3-server = 3.1.3-13 - -%description server -%{summary}. - -%prep -%setup -q -n apache-%{name}-%{version}-src -%patch2 -p1 -pushd client -%patch0 -b .sav -popd -pushd common -%patch1 -b .sav -popd -pushd server -%patch3 -b .sav -popd -%patch4 -p1 -%patch5 -p1 - -sed -i 's/\r//' LICENSE.txt - -%pom_disable_module dist -%pom_remove_dep jaxme:jaxmeapi common -# This dep is no longer supplied by ws-commons-util -%pom_add_dep junit:junit:3.8.1:test - -%mvn_file :{*} @1 -%mvn_package :*-common %{name} - -%build -# FIXME: ignore test failure because server part needs network -%mvn_build -s -- -Dmaven.test.failure.ignore=true - -%install -%mvn_install - -%files common -f .mfiles-%{name} -%license LICENSE.txt NOTICE.txt - -%files client -f .mfiles-%{name}-client - -%files server -f .mfiles-%{name}-server - -%files javadoc -f .mfiles-javadoc -%license LICENSE.txt NOTICE.txt - -%changelog -* Sat Jul 27 2019 Fedora Release Engineering - 1:3.1.3-23 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Sun Feb 03 2019 Fedora Release Engineering - 1:3.1.3-22 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Sat Jul 14 2018 Fedora Release Engineering - 1:3.1.3-21 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Fri May 18 2018 Michael Simacek - 1:3.1.3-20 -- Disallow deserialization of tags by default -- Resolves CVE-2016-5003 -- Disallow loading of external DTD -- Resolves CVE-2016-5002 - -* Fri Feb 09 2018 Fedora Release Engineering - 1:3.1.3-19 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 1:3.1.3-18 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Mon Jun 12 2017 Troy Dawson - 1:3.1.3-17 -- Add junit to pom deps. Was originally supplied by ws-commons-util (#1460767) - -* Sat Feb 11 2017 Fedora Release Engineering - 1:3.1.3-16 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Thu Jan 12 2017 Igor Gnatenko - 1:3.1.3-15 -- Rebuild for readline 7.x - -* Fri Feb 05 2016 Fedora Release Engineering - 1:3.1.3-14 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Fri Jun 19 2015 Fedora Release Engineering - 1:3.1.3-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Fri Feb 13 2015 gil cattaneo 1:3.1.3-12 -- introduce license macro - -* Thu Jul 10 2014 Sami Wagiaalla - 1:3.1.3-11 -- Add OSGi info for xmlrpc-server jar. -- export o.a.xmlrpc from xmlrpc-client jar. - -* Mon Jun 16 2014 Mikolaj Izdebski - 1:3.1.3-10 -- Use servlet 3.1.0 API - -* Sun Jun 08 2014 Fedora Release Engineering - 1:3.1.3-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Tue Mar 04 2014 Stanislav Ochotnicky - 1:3.1.3-8 -- Use Requires: java-headless rebuild (#1067528) - -* Sun Aug 04 2013 Fedora Release Engineering - 1:3.1.3-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Fri Jun 14 2013 Mikolaj Izdebski - 1:3.1.3-6 -- Update to current packaging guidelines - -* Fri May 17 2013 Alexander Kurtakov 1:3.1.3-5 -- Remove javax.xml.bind from osgi imports - it's part of the JVM now. -- Drop the ws-jaxme dependency for the same reason. - -* Fri Feb 15 2013 Fedora Release Engineering - 1:3.1.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild - -* Wed Feb 06 2013 Java SIG - 1:3.1.3-3 -- Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild -- Replace maven BuildRequires with maven-local - -* Sat Oct 20 2012 Peter Robinson 3.1.3-2 -- xmlrpc v2 had an Epoch so we need one here. Add it back - -* Fri Sep 14 2012 Alexander Kurtakov 3.1.3-1 -- First release of version 3.x package From 5319ef0e20975cafe228ae3a8abb4e02363baafc Mon Sep 17 00:00:00 2001 From: Tomas Hrcka Date: Wed, 1 Apr 2020 17:05:22 +0200 Subject: [PATCH 14/20] Revert "Orphaned for 6+ weeks" This reverts commit 0a09e0d088b4815e8190a0eec1a93324750807da. Unretirement request: https://pagure.io/releng/issue/9370 Signed-off-by: Tomas Hrcka --- .gitignore | 2 + .project | 17 ++ changelog-pre3.x.txt | 120 ++++++++ dead.package | 1 - sources | 1 + xmlrpc-client-addosgimanifest.patch | 20 ++ xmlrpc-common-addosgimanifest.patch | 19 ++ ...erialization-of-ex-serializable-tags.patch | 35 +++ xmlrpc-disallow-loading-external-dtd.patch | 30 ++ xmlrpc-javax-methods.patch | 264 ++++++++++++++++++ xmlrpc-server-addosgimanifest.patch | 15 + xmlrpc.spec | 181 ++++++++++++ 12 files changed, 704 insertions(+), 1 deletion(-) create mode 100644 .gitignore create mode 100644 .project create mode 100644 changelog-pre3.x.txt delete mode 100644 dead.package create mode 100644 sources create mode 100644 xmlrpc-client-addosgimanifest.patch create mode 100644 xmlrpc-common-addosgimanifest.patch create mode 100644 xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch create mode 100644 xmlrpc-disallow-loading-external-dtd.patch create mode 100644 xmlrpc-javax-methods.patch create mode 100644 xmlrpc-server-addosgimanifest.patch create mode 100644 xmlrpc.spec diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..6de88cd --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +xmlrpc-2.0.1-src.tar.gz +/apache-xmlrpc-3.1.3-src.tar.bz2 diff --git a/.project b/.project new file mode 100644 index 0000000..d3cdf74 --- /dev/null +++ b/.project @@ -0,0 +1,17 @@ + + + xmlrpc + + + + + + org.eclipse.linuxtools.rpm.rpmlint.rpmlintBuilder + + + + + + org.eclipse.linuxtools.rpm.rpmlint.rpmlintNature + + diff --git a/changelog-pre3.x.txt b/changelog-pre3.x.txt new file mode 100644 index 0000000..9cef632 --- /dev/null +++ b/changelog-pre3.x.txt @@ -0,0 +1,120 @@ +* Sun Jul 22 2012 Fedora Release Engineering - 0:2.0.1-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Tue Jun 05 2012 Stanislav Ochotnicky - 0:2.0.1-12 +- Migrate to new tomcat-servlet-api + +* Sat Jan 14 2012 Fedora Release Engineering - 0:2.0.1-11 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild + +* Mon Feb 07 2011 Fedora Release Engineering - 0:2.0.1-10 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Tue Dec 21 2010 Stanislav Ochotnicky - 0:2.0.1-9 +- Require java >= 1:1.6.0 +- Fix classpaths to ensure building of all optional features +- Remove stale patch + +* Thu Dec 16 2010 Stanislav Ochotnicky - 0:2.0.1-8 +- Migrate from old servlet api to new one + +* Thu Dec 9 2010 Stanislav Ochotnicky - 0:2.0.1-7 +- Remove gcj support +- Make jars/javadocs versionless +- Add ws-commons-util Requires +- Use apache-commons-codec +- Drop unneeded patch for jsse + +* Thu Mar 11 2010 Peter Lemenkov - 0:2.0.1-6.6 +- Added missing requires jpackage-utils + +* Mon Jul 27 2009 Fedora Release Engineering - 0:2.0.1-6.5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Thu Feb 26 2009 Fedora Release Engineering - 0:2.0.1-5.5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Thu Jul 10 2008 Tom "spot" Callaway - 0:2.0.1-4.5 +- drop repotag + +* Thu May 29 2008 Tom "spot" Callaway - 0:2.0.1-4jpp.4 +- fix license tag + +* Tue Feb 19 2008 Fedora Release Engineering - 0:2.0.1-4jpp.3 +- Autorebuild for GCC 4.3 + +* Tue Mar 27 2007 Matt Wringe 0:2.0.1-3jpp.3 +- Spec file clean up for Fedora Extras Review + +* Thu Mar 08 2007 Deepak Bhole 2.0.1-3jpp.2 +- Add javax.net.ssl support to build org.apache.xmlrpc.secure.* +- Minor spec file cleanup + +* Fri Aug 04 2006 Vivek Lakshmanan - 0:2.0.1-3jpp.1 +- Merge with latest from JPP. + +* Sat Jul 22 2006 Jakub Jelinek - 0:2.0.1-1jpp_8.2fc +- Rebuilt + +* Wed Jul 12 2006 Jesse Keating - 0:2.0.1-1jpp_8.1fc +- rebuild + +* Wed Mar 8 2006 Rafael Schloming - 0:2.0.1-1jpp_7fc +- excluded s390 due to eclipse + +* Mon Mar 6 2006 Jeremy Katz - 0:2.0.1-1jpp_6fc +- stop scriptlet spew + +* Fri Feb 24 2006 Igor Foox - 0:2.0.1-1jpp_5fc +- Added post/postun dependency on coreutils. + +* Fri Feb 10 2006 Jesse Keating - 0:2.0.1-1jpp_4fc +- bump again for double-long bug on ppc(64) + +* Tue Feb 07 2006 Jesse Keating - 0:2.0.1-1jpp_3fc +- rebuilt for new gcc4.1 snapshot and glibc changes + +* Wed Jan 25 2006 Igor Foox 0:2.0.1-1jpp_2fc +- ExcludeArch s390x and ppc64 + +* Wed Jan 18 2006 Andrew Overholt 0:2.0.1-1jpp_2fc +- Comment out JPackage Distribution and Vendor tags + +* Wed Jan 18 2006 Jesse Keating 0:2.0.1-1jpp_2fc +- bump for test + +* Wed Jan 18 2006 Igor Foox 0:2.0.1-1jpp_1fc +- Update to version 2.0.1 +- Natively compile + +* Thu Aug 26 2004 Ralph Apel 0:1.2-0.b1.3jpp +- Build with ant-1.6.2 + +* Thu Apr 29 2004 David Walluck 0:1.2-0.b1.2jpp +- add jar symlinks +- remove %%buildroot in %%install + +* Tue May 06 2003 David Walluck 0:1.2-0.b1.1jpp +- 1.2-b1 +- update for JPackage 1.5 + +* Mon Mar 18 2002 Guillaume Rousse 1.1-1jpp +- 1.1 +- generic servlet support +- used source release +- dropped patch +- added applet jar + +* Mon Jan 21 2002 Guillaume Rousse 1.0-3jpp +- versioned dir for javadoc +- no dependencies for javadoc package +- dropped jsse package +- adaptation to new servlet3 package +- adaptation to new jsse package +- section macro + +* Fri Dec 7 2001 Guillaume Rousse 1.0-2jpp +- javadoc into javadoc package + +* Sat Nov 3 2001 Guillaume Rousse 1.0-1jpp +- first JPackage release diff --git a/dead.package b/dead.package deleted file mode 100644 index 5204a84..0000000 --- a/dead.package +++ /dev/null @@ -1 +0,0 @@ -Orphaned for 6+ weeks diff --git a/sources b/sources new file mode 100644 index 0000000..f4bbd2c --- /dev/null +++ b/sources @@ -0,0 +1 @@ +f7817485fa6a6a500c49ec9515d1f3b9 apache-xmlrpc-3.1.3-src.tar.bz2 diff --git a/xmlrpc-client-addosgimanifest.patch b/xmlrpc-client-addosgimanifest.patch new file mode 100644 index 0000000..437d78f --- /dev/null +++ b/xmlrpc-client-addosgimanifest.patch @@ -0,0 +1,20 @@ +--- pom.xml.sav 2010-02-06 17:44:57.000000000 +0200 ++++ pom.xml 2010-09-29 09:27:06.194857352 +0300 +@@ -48,6 +48,17 @@ + org.apache + Apache Software Foundation + ${project.version} ++ 2 ++ %Bundle-Name ++ plugin ++ org.apache.xmlrpc ++ ${project.version} ++ org.apache.xmlrpc.common ++ org.apache.xmlrpc, org.apache.xmlrpc.client, org.apache.xmlrpc.client.util ++ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers ++ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 ++ dependent ++ %Bundle-Vendor.0 + + + diff --git a/xmlrpc-common-addosgimanifest.patch b/xmlrpc-common-addosgimanifest.patch new file mode 100644 index 0000000..4d4aeca --- /dev/null +++ b/xmlrpc-common-addosgimanifest.patch @@ -0,0 +1,19 @@ +--- pom.xml.sav 2010-02-06 17:44:50.000000000 +0200 ++++ pom.xml 2010-09-29 09:30:38.857857644 +0300 +@@ -48,6 +48,16 @@ + org.apache + Apache Software Foundation + ${project.version} ++ 2 ++ %Bundle-Name ++ plugin ++ org.apache.xmlrpc.common ++ ${project.version} ++ org.apache.xmlrpc, org.apache.xmlrpc.common, org.apache.xmlrpc.jaxb, org.apache.xmlrpc.parser, org.apache.xmlrpc.serializer, org.apache.xmlrpc.util ++ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers ++ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 ++ dependent ++ %Bundle-Vendor.0 + + + diff --git a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch new file mode 100644 index 0000000..53a0a98 --- /dev/null +++ b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch @@ -0,0 +1,35 @@ +From 495d6136d9de5c0bbddadffe11b0841c6aafcb34 Mon Sep 17 00:00:00 2001 +From: Michael Simacek +Date: Fri, 18 May 2018 15:22:49 +0200 +Subject: [PATCH 1/2] Disallow deserialization of tags + +Can be reenabled by setting JVM property +org.apache.xmlrpc.allowInsecureDeserialization to 1. + +- Resolves CVE-2016-5003 +--- + .../java/org/apache/xmlrpc/parser/SerializableParser.java | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java +index 18f25ac..c8bb7ed 100644 +--- a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java ++++ b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java +@@ -29,6 +29,14 @@ import org.apache.xmlrpc.XmlRpcException; + */ + public class SerializableParser extends ByteArrayParser { + public Object getResult() throws XmlRpcException { ++ if (!"1".equals(System.getProperty("org.apache.xmlrpc.allowInsecureDeserialization"))) { ++ throw new UnsupportedOperationException( ++ "Deserialization of ex:serializable objects is vulnerable to " + ++ "remote execution attacks and is disabled by default. " + ++ "If you are sure the source data is trusted, you can enable " + ++ "it by setting org.apache.xmlrpc.allowInsecureDeserialization " + ++ "JVM property to 1"); ++ } + try { + byte[] res = (byte[]) super.getResult(); + ByteArrayInputStream bais = new ByteArrayInputStream(res); +-- +2.17.0 + diff --git a/xmlrpc-disallow-loading-external-dtd.patch b/xmlrpc-disallow-loading-external-dtd.patch new file mode 100644 index 0000000..f59b9c0 --- /dev/null +++ b/xmlrpc-disallow-loading-external-dtd.patch @@ -0,0 +1,30 @@ +From 338ab231b228bd36afda4ab31db724c6669579b2 Mon Sep 17 00:00:00 2001 +From: Michael Simacek +Date: Tue, 22 May 2018 10:53:28 +0200 +Subject: [PATCH 2/2] Disallow loading external DTD + +--- + .../src/main/java/org/apache/xmlrpc/util/SAXParsers.java | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java +index b1034e7..49ef5de 100644 +--- a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java ++++ b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java +@@ -48,6 +48,13 @@ public class SAXParsers { + } catch (org.xml.sax.SAXException e) { + // Ignore it + } ++ try { ++ spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); ++ } catch (javax.xml.parsers.ParserConfigurationException e) { ++ // Ignore it ++ } catch (org.xml.sax.SAXException e) { ++ // Ignore it ++ } + } + + /** Creates a new instance of {@link XMLReader}. +-- +2.17.0 + diff --git a/xmlrpc-javax-methods.patch b/xmlrpc-javax-methods.patch new file mode 100644 index 0000000..0c66b6c --- /dev/null +++ b/xmlrpc-javax-methods.patch @@ -0,0 +1,264 @@ +From d6834da0b1556bb133a534d31bb94d08f38fa195 Mon Sep 17 00:00:00 2001 +From: Mikolaj Izdebski +Date: Mon, 16 Jun 2014 10:03:35 +0200 +Subject: [PATCH] Use servlet 3.1.0 API + +--- + dist/pom.xml | 2 +- + pom.xml | 4 +- + server/pom.xml | 8 +++- + .../xmlrpc/webserver/HttpServletRequestImpl.java | 54 ++++++++++++++++++++++ + .../xmlrpc/webserver/HttpServletResponseImpl.java | 26 ++++++++++- + .../xmlrpc/webserver/ServletOutputStreamImpl.java | 5 ++ + 6 files changed, 94 insertions(+), 5 deletions(-) + +diff --git a/dist/pom.xml b/dist/pom.xml +index 67aded6..c18c2eb 100644 +--- a/dist/pom.xml ++++ b/dist/pom.xml +@@ -59,7 +59,7 @@ + + + javax.servlet +- servlet-api ++ javax.servlet-api + + + org.apache.xmlrpc +diff --git a/pom.xml b/pom.xml +index 3933da5..70c508e 100644 +--- a/pom.xml ++++ b/pom.xml +@@ -344,8 +344,8 @@ + + + javax.servlet +- servlet-api +- 2.4 ++ javax.servlet-api ++ 3.1.0 + provided + + +diff --git a/server/pom.xml b/server/pom.xml +index 0d09544..01288c8 100644 +--- a/server/pom.xml ++++ b/server/pom.xml +@@ -67,6 +67,12 @@ + + commons-logging + commons-logging ++ ++ ++ javax.servlet ++ servlet-api ++ ++ + + + org.apache.xmlrpc +@@ -81,7 +87,7 @@ + + + javax.servlet +- servlet-api ++ javax.servlet-api + + + commons-httpclient +diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java +index 3dc7e43..19b14a2 100644 +--- a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java ++++ b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java +@@ -31,6 +31,7 @@ import java.net.URLDecoder; + import java.security.Principal; + import java.util.ArrayList; + import java.util.Collections; ++import java.util.Collection; + import java.util.Enumeration; + import java.util.HashMap; + import java.util.Iterator; +@@ -39,10 +40,20 @@ import java.util.Locale; + import java.util.Map; + import java.util.StringTokenizer; + ++import javax.servlet.ReadListener; + import javax.servlet.RequestDispatcher; ++import javax.servlet.ServletException; + import javax.servlet.ServletInputStream; ++import javax.servlet.DispatcherType; ++import javax.servlet.AsyncContext; ++import javax.servlet.ServletContext; ++import javax.servlet.ServletRequest; ++import javax.servlet.ServletResponse; + import javax.servlet.http.Cookie; ++import javax.servlet.http.HttpUpgradeHandler; ++import javax.servlet.http.Part; + import javax.servlet.http.HttpServletRequest; ++import javax.servlet.http.HttpServletResponse; + import javax.servlet.http.HttpSession; + + import org.apache.xmlrpc.common.XmlRpcStreamConfig; +@@ -66,6 +77,7 @@ public class HttpServletRequestImpl implements HttpServletRequest { + private String queryString; + private String httpVersion; + private final Map headers = new HashMap(); ++ private final Map parts = new HashMap(); + private final Map attributes = new HashMap(); + private Map parameters; + private String characterEncoding; +@@ -97,6 +109,18 @@ public class HttpServletRequestImpl implements HttpServletRequest { + } + return c; + } ++ ++ public boolean isFinished() { ++ return contentBytesRemaining == 0; ++ } ++ ++ public boolean isReady() { ++ return true; ++ } ++ ++ public void setReadListener(ReadListener arg0) { ++ throw new IllegalStateException("Not implemented."); ++ } + }; + } + +@@ -227,6 +251,12 @@ public class HttpServletRequestImpl implements HttpServletRequest { + return Collections.enumeration(list); + } + ++ public Part getPart(String name) { throw new IllegalStateException("Not implemented"); } ++ ++ public Collection getParts() { throw new IllegalStateException("Not implemented"); } ++ ++ public boolean authenticate (HttpServletResponse response) { throw new IllegalStateException("Not implemented"); } ++ + public int getIntHeader(String pHeader) { + String s = getHeader(pHeader); + return s == null ? -1 : Integer.parseInt(s); +@@ -242,6 +272,10 @@ public class HttpServletRequestImpl implements HttpServletRequest { + + public String getRemoteUser() { throw new IllegalStateException("Not implemented"); } + ++ public void login(String username, String password) { throw new IllegalStateException("Not implemented"); } ++ ++ public void logout() { throw new IllegalStateException("Not implemented"); } ++ + public String getRequestURI() { return uri; } + + public StringBuffer getRequestURL() { +@@ -280,6 +314,20 @@ public class HttpServletRequestImpl implements HttpServletRequest { + return sb; + } + ++ public AsyncContext getAsyncContext() { throw new IllegalStateException("Not implemented"); } ++ ++ public boolean isAsyncSupported() { return false; } ++ ++ public boolean isAsyncStarted() { return false; } ++ ++ public ServletContext getServletContext() { throw new IllegalStateException("Not implemented"); } ++ ++ public AsyncContext startAsync(ServletRequest req, ServletResponse resp) { throw new IllegalStateException("Not implemented"); } ++ ++ public AsyncContext startAsync() { throw new IllegalStateException("Not implemented"); } ++ ++ public DispatcherType getDispatcherType() { throw new IllegalStateException("Not implemented"); } ++ + public String getRequestedSessionId() { throw new IllegalStateException("Not implemented"); } + + public String getServletPath() { return uri; } +@@ -544,4 +592,10 @@ public class HttpServletRequestImpl implements HttpServletRequest { + } + + protected String getHttpVersion() { return httpVersion; } ++ ++ public long getContentLengthLong() { throw new IllegalStateException("Not implemented."); } ++ ++ public String changeSessionId() { throw new IllegalStateException("Not implemented."); } ++ ++ public HttpUpgradeHandler upgrade(Class arg0) { throw new IllegalStateException("Not implemented."); } + } +diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java +index 6ba7018..5319dcf 100644 +--- a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java ++++ b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java +@@ -29,6 +29,8 @@ import java.util.Iterator; + import java.util.List; + import java.util.Locale; + import java.util.Map; ++import java.util.Collection; ++import java.util.Collections; + import java.util.StringTokenizer; + + import javax.servlet.ServletOutputStream; +@@ -84,7 +86,7 @@ public class HttpServletResponseImpl implements HttpServletResponse { + } + } + +- private String getHeader(String pHeader) { ++ public String getHeader(String pHeader) { + String key = pHeader.toLowerCase(); + Object o = headers.get(key); + if (o == null) { +@@ -101,6 +103,26 @@ public class HttpServletResponseImpl implements HttpServletResponse { + } + } + ++ public Collection getHeaderNames() { ++ return headers.keySet(); ++ } ++ ++ public Collection getHeaders(String pHeader) { ++ String key = pHeader.toLowerCase(); ++ Object o = headers.get(key); ++ List list; ++ if (o instanceof List) { ++ list = (List) o; ++ } else { ++ list = Collections.singletonList(o); ++ } ++ return list; ++ } ++ ++ public int getStatus() { ++ return status; ++ } ++ + public void addIntHeader(String pHeader, int pValue) { + addHeader(pHeader, Integer.toString(pValue)); + } +@@ -465,4 +487,6 @@ public class HttpServletResponseImpl implements HttpServletResponse { + sb.append("\r\n"); + return sb.toString(); + } ++ ++ public void setContentLengthLong(long arg0) { throw new IllegalStateException("Not implemented."); } + } +diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java +index c2a53b1..86dbbb4 100644 +--- a/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java ++++ b/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java +@@ -22,6 +22,7 @@ import java.io.IOException; + import java.io.OutputStream; + + import javax.servlet.ServletOutputStream; ++import javax.servlet.WriteListener; + + + /** Default implementation of a servlet output stream. +@@ -99,4 +100,8 @@ class ServletOutputStreamImpl extends ServletOutputStream { + boolean isCommitted() { + return committed; + } ++ ++ public boolean isReady() { return true; } ++ ++ public void setWriteListener(WriteListener arg0) { throw new IllegalStateException("Not implemented."); } + } +-- +1.9.3 + diff --git a/xmlrpc-server-addosgimanifest.patch b/xmlrpc-server-addosgimanifest.patch new file mode 100644 index 0000000..af54e20 --- /dev/null +++ b/xmlrpc-server-addosgimanifest.patch @@ -0,0 +1,15 @@ +--- pom.xml 2014-07-07 11:24:52.668887604 -0400 ++++ pom.xml.sav 2014-07-07 11:25:06.174916380 -0400 +@@ -48,6 +48,12 @@ + org.apache + Apache Software Foundation + ${project.version} ++ 1 ++ %Bundle-Name ++ org.apache.xmlrpc.server ++ ${project.version} ++ org.apache.xmlrpc.common ++ org.apache.xmlrpc.server,org.apache.xmlrpc.webserver + + + diff --git a/xmlrpc.spec b/xmlrpc.spec new file mode 100644 index 0000000..2979844 --- /dev/null +++ b/xmlrpc.spec @@ -0,0 +1,181 @@ +Name: xmlrpc +Version: 3.1.3 +Release: 23%{?dist} +Epoch: 1 +Summary: Java XML-RPC implementation +License: ASL 2.0 +URL: http://ws.apache.org/xmlrpc/ +BuildArch: noarch + +Source0: http://www.apache.org/dist/ws/xmlrpc/sources/apache-xmlrpc-%{version}-src.tar.bz2 +Patch0: %{name}-client-addosgimanifest.patch +Patch1: %{name}-common-addosgimanifest.patch +Patch2: %{name}-javax-methods.patch +Patch3: %{name}-server-addosgimanifest.patch +Patch4: %{name}-disallow-deserialization-of-ex-serializable-tags.patch +Patch5: %{name}-disallow-loading-external-dtd.patch + +BuildRequires: maven-local +BuildRequires: mvn(org.apache:apache:pom:) +BuildRequires: mvn(commons-httpclient:commons-httpclient) +BuildRequires: mvn(commons-logging:commons-logging) +BuildRequires: mvn(javax.servlet:servlet-api) +BuildRequires: mvn(org.apache.ws.commons.util:ws-commons-util) + + +%description +Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol +that uses XML over HTTP to implement remote procedure calls. +Apache XML-RPC was previously known as Helma XML-RPC. If you have code +using the Helma library, all you should have to do is change the import +statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*. + +%package javadoc +Summary: Javadoc for %{name} + +%description javadoc +Javadoc for %{name}. + +%package common +Summary: Common classes for XML-RPC client and server implementations +# Provide xmlrpc is not here because it would be useless due to different jar names +Obsoletes: %{name} < 3.1.3 +Obsoletes: %{name}3-common < 3.1.3-13 +Provides: %{name}3-common = 3.1.3-13 + +%description common +%{summary}. + +%package client +Summary: XML-RPC client implementation +Obsoletes: %{name}3-client < 3.1.3-13 +Provides: %{name}3-client = 3.1.3-13 + +%description client +%{summary}. + +%package server +Summary: XML-RPC server implementation +Obsoletes: %{name}3-server < 3.1.3-13 +Provides: %{name}3-server = 3.1.3-13 + +%description server +%{summary}. + +%prep +%setup -q -n apache-%{name}-%{version}-src +%patch2 -p1 +pushd client +%patch0 -b .sav +popd +pushd common +%patch1 -b .sav +popd +pushd server +%patch3 -b .sav +popd +%patch4 -p1 +%patch5 -p1 + +sed -i 's/\r//' LICENSE.txt + +%pom_disable_module dist +%pom_remove_dep jaxme:jaxmeapi common +# This dep is no longer supplied by ws-commons-util +%pom_add_dep junit:junit:3.8.1:test + +%mvn_file :{*} @1 +%mvn_package :*-common %{name} + +%build +# FIXME: ignore test failure because server part needs network +%mvn_build -s -- -Dmaven.test.failure.ignore=true + +%install +%mvn_install + +%files common -f .mfiles-%{name} +%license LICENSE.txt NOTICE.txt + +%files client -f .mfiles-%{name}-client + +%files server -f .mfiles-%{name}-server + +%files javadoc -f .mfiles-javadoc +%license LICENSE.txt NOTICE.txt + +%changelog +* Sat Jul 27 2019 Fedora Release Engineering - 1:3.1.3-23 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Sun Feb 03 2019 Fedora Release Engineering - 1:3.1.3-22 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Sat Jul 14 2018 Fedora Release Engineering - 1:3.1.3-21 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Fri May 18 2018 Michael Simacek - 1:3.1.3-20 +- Disallow deserialization of tags by default +- Resolves CVE-2016-5003 +- Disallow loading of external DTD +- Resolves CVE-2016-5002 + +* Fri Feb 09 2018 Fedora Release Engineering - 1:3.1.3-19 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Thu Jul 27 2017 Fedora Release Engineering - 1:3.1.3-18 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Mon Jun 12 2017 Troy Dawson - 1:3.1.3-17 +- Add junit to pom deps. Was originally supplied by ws-commons-util (#1460767) + +* Sat Feb 11 2017 Fedora Release Engineering - 1:3.1.3-16 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Thu Jan 12 2017 Igor Gnatenko - 1:3.1.3-15 +- Rebuild for readline 7.x + +* Fri Feb 05 2016 Fedora Release Engineering - 1:3.1.3-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Fri Jun 19 2015 Fedora Release Engineering - 1:3.1.3-13 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Fri Feb 13 2015 gil cattaneo 1:3.1.3-12 +- introduce license macro + +* Thu Jul 10 2014 Sami Wagiaalla - 1:3.1.3-11 +- Add OSGi info for xmlrpc-server jar. +- export o.a.xmlrpc from xmlrpc-client jar. + +* Mon Jun 16 2014 Mikolaj Izdebski - 1:3.1.3-10 +- Use servlet 3.1.0 API + +* Sun Jun 08 2014 Fedora Release Engineering - 1:3.1.3-9 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Tue Mar 04 2014 Stanislav Ochotnicky - 1:3.1.3-8 +- Use Requires: java-headless rebuild (#1067528) + +* Sun Aug 04 2013 Fedora Release Engineering - 1:3.1.3-7 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Fri Jun 14 2013 Mikolaj Izdebski - 1:3.1.3-6 +- Update to current packaging guidelines + +* Fri May 17 2013 Alexander Kurtakov 1:3.1.3-5 +- Remove javax.xml.bind from osgi imports - it's part of the JVM now. +- Drop the ws-jaxme dependency for the same reason. + +* Fri Feb 15 2013 Fedora Release Engineering - 1:3.1.3-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild + +* Wed Feb 06 2013 Java SIG - 1:3.1.3-3 +- Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild +- Replace maven BuildRequires with maven-local + +* Sat Oct 20 2012 Peter Robinson 3.1.3-2 +- xmlrpc v2 had an Epoch so we need one here. Add it back + +* Fri Sep 14 2012 Alexander Kurtakov 3.1.3-1 +- First release of version 3.x package From 86ddcbd5daffcd1a9b62a1c389b0188ac4b7c6e3 Mon Sep 17 00:00:00 2001 From: Mat Booth Date: Wed, 1 Apr 2020 16:26:30 +0100 Subject: [PATCH 15/20] Add patch for CVE-2019-17570 --- ...hods.patch => 0001-Javax-Servlet-API.patch | 48 +- 0002-Add-OSGi-metadata.patch | 74 +++ ...erialization-of-ex-serializable-tags.patch | 71 +++ ...> 0004-disallow-loading-external-dtd.patch | 10 +- ...ve-dep-on-ancient-commons-httpclient.patch | 466 ++++++++++++++++++ 0006-Fix-for-CVE-2019-17570.patch | 52 ++ changelog-pre3.x.txt | 120 ----- xmlrpc-client-addosgimanifest.patch | 20 - xmlrpc-common-addosgimanifest.patch | 19 - ...erialization-of-ex-serializable-tags.patch | 35 -- xmlrpc-server-addosgimanifest.patch | 15 - xmlrpc.spec | 73 ++- 12 files changed, 727 insertions(+), 276 deletions(-) rename xmlrpc-javax-methods.patch => 0001-Javax-Servlet-API.patch (92%) create mode 100644 0002-Add-OSGi-metadata.patch create mode 100644 0003-disallow-deserialization-of-ex-serializable-tags.patch rename xmlrpc-disallow-loading-external-dtd.patch => 0004-disallow-loading-external-dtd.patch (81%) create mode 100644 0005-Remove-dep-on-ancient-commons-httpclient.patch create mode 100644 0006-Fix-for-CVE-2019-17570.patch delete mode 100644 changelog-pre3.x.txt delete mode 100644 xmlrpc-client-addosgimanifest.patch delete mode 100644 xmlrpc-common-addosgimanifest.patch delete mode 100644 xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch delete mode 100644 xmlrpc-server-addosgimanifest.patch diff --git a/xmlrpc-javax-methods.patch b/0001-Javax-Servlet-API.patch similarity index 92% rename from xmlrpc-javax-methods.patch rename to 0001-Javax-Servlet-API.patch index 0c66b6c..c6a4f93 100644 --- a/xmlrpc-javax-methods.patch +++ b/0001-Javax-Servlet-API.patch @@ -1,19 +1,19 @@ -From d6834da0b1556bb133a534d31bb94d08f38fa195 Mon Sep 17 00:00:00 2001 -From: Mikolaj Izdebski -Date: Mon, 16 Jun 2014 10:03:35 +0200 -Subject: [PATCH] Use servlet 3.1.0 API +From a552fe2cd20c9804d9abcbf5f99533ed9c495fe7 Mon Sep 17 00:00:00 2001 +From: Mat Booth +Date: Tue, 31 Mar 2020 16:58:31 +0100 +Subject: [PATCH 1/6] Javax Servlet API --- - dist/pom.xml | 2 +- - pom.xml | 4 +- - server/pom.xml | 8 +++- - .../xmlrpc/webserver/HttpServletRequestImpl.java | 54 ++++++++++++++++++++++ - .../xmlrpc/webserver/HttpServletResponseImpl.java | 26 ++++++++++- - .../xmlrpc/webserver/ServletOutputStreamImpl.java | 5 ++ + dist/pom.xml | 2 +- + pom.xml | 4 +- + server/pom.xml | 8 ++- + .../webserver/HttpServletRequestImpl.java | 54 +++++++++++++++++++ + .../webserver/HttpServletResponseImpl.java | 26 ++++++++- + .../webserver/ServletOutputStreamImpl.java | 5 ++ 6 files changed, 94 insertions(+), 5 deletions(-) diff --git a/dist/pom.xml b/dist/pom.xml -index 67aded6..c18c2eb 100644 +index 67aded6..590f750 100644 --- a/dist/pom.xml +++ b/dist/pom.xml @@ -59,7 +59,7 @@ @@ -21,12 +21,12 @@ index 67aded6..c18c2eb 100644 javax.servlet - servlet-api -+ javax.servlet-api ++ javax.servlet-api org.apache.xmlrpc diff --git a/pom.xml b/pom.xml -index 3933da5..70c508e 100644 +index 3933da5..5e18625 100644 --- a/pom.xml +++ b/pom.xml @@ -344,8 +344,8 @@ @@ -35,25 +35,25 @@ index 3933da5..70c508e 100644 javax.servlet - servlet-api - 2.4 -+ javax.servlet-api -+ 3.1.0 ++ javax.servlet-api ++ 3.1.0 provided diff --git a/server/pom.xml b/server/pom.xml -index 0d09544..01288c8 100644 +index 0d09544..6cbc6e7 100644 --- a/server/pom.xml +++ b/server/pom.xml @@ -67,6 +67,12 @@ commons-logging commons-logging -+ -+ -+ javax.servlet -+ servlet-api -+ -+ ++ ++ ++ javax.servlet ++ servlet-api ++ ++ org.apache.xmlrpc @@ -62,7 +62,7 @@ index 0d09544..01288c8 100644 javax.servlet - servlet-api -+ javax.servlet-api ++ javax.servlet-api commons-httpclient @@ -260,5 +260,5 @@ index c2a53b1..86dbbb4 100644 + public void setWriteListener(WriteListener arg0) { throw new IllegalStateException("Not implemented."); } } -- -1.9.3 +2.26.0.rc2 diff --git a/0002-Add-OSGi-metadata.patch b/0002-Add-OSGi-metadata.patch new file mode 100644 index 0000000..b3e4c77 --- /dev/null +++ b/0002-Add-OSGi-metadata.patch @@ -0,0 +1,74 @@ +From 56ed627f9d69a9c065aab02e8f7d07524d4fa315 Mon Sep 17 00:00:00 2001 +From: Mat Booth +Date: Tue, 31 Mar 2020 17:00:03 +0100 +Subject: [PATCH 2/6] Add OSGi metadata + +--- + client/pom.xml | 11 +++++++++++ + common/pom.xml | 10 ++++++++++ + server/pom.xml | 6 ++++++ + 3 files changed, 27 insertions(+) + +diff --git a/client/pom.xml b/client/pom.xml +index e588657..f31b2d2 100644 +--- a/client/pom.xml ++++ b/client/pom.xml +@@ -48,6 +48,17 @@ + org.apache + Apache Software Foundation + ${project.version} ++ 2 ++ %Bundle-Name ++ plugin ++ org.apache.xmlrpc ++ ${project.version} ++ org.apache.xmlrpc.common ++ org.apache.xmlrpc, org.apache.xmlrpc.client, org.apache.xmlrpc.client.util ++ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers ++ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 ++ dependent ++ %Bundle-Vendor.0 + + + +diff --git a/common/pom.xml b/common/pom.xml +index 5058d50..7a5bf49 100644 +--- a/common/pom.xml ++++ b/common/pom.xml +@@ -48,6 +48,16 @@ + org.apache + Apache Software Foundation + ${project.version} ++ 2 ++ %Bundle-Name ++ plugin ++ org.apache.xmlrpc.common ++ ${project.version} ++ org.apache.xmlrpc, org.apache.xmlrpc.common, org.apache.xmlrpc.jaxb, org.apache.xmlrpc.parser, org.apache.xmlrpc.serializer, org.apache.xmlrpc.util ++ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers ++ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 ++ dependent ++ %Bundle-Vendor.0 + + + +diff --git a/server/pom.xml b/server/pom.xml +index 6cbc6e7..4c90e50 100644 +--- a/server/pom.xml ++++ b/server/pom.xml +@@ -48,6 +48,12 @@ + org.apache + Apache Software Foundation + ${project.version} ++ 1 ++ %Bundle-Name ++ org.apache.xmlrpc.server ++ ${project.version} ++ org.apache.xmlrpc.common ++ org.apache.xmlrpc.server,org.apache.xmlrpc.webserver + + + +-- +2.26.0.rc2 + diff --git a/0003-disallow-deserialization-of-ex-serializable-tags.patch b/0003-disallow-deserialization-of-ex-serializable-tags.patch new file mode 100644 index 0000000..0b568c7 --- /dev/null +++ b/0003-disallow-deserialization-of-ex-serializable-tags.patch @@ -0,0 +1,71 @@ +From febe70f7ca78926660a7d11607a35f663165322a Mon Sep 17 00:00:00 2001 +From: Mat Booth +Date: Tue, 31 Mar 2020 17:01:29 +0100 +Subject: [PATCH 3/6] disallow deserialization of ex serializable tags + +--- + .../xmlrpc/parser/SerializableParser.java | 8 ++++++ + .../java/org/apache/xmlrpc/test/BaseTest.java | 28 ------------------- + 2 files changed, 8 insertions(+), 28 deletions(-) + +diff --git a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java +index 18f25ac..c8bb7ed 100644 +--- a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java ++++ b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java +@@ -29,6 +29,14 @@ import org.apache.xmlrpc.XmlRpcException; + */ + public class SerializableParser extends ByteArrayParser { + public Object getResult() throws XmlRpcException { ++ if (!"1".equals(System.getProperty("org.apache.xmlrpc.allowInsecureDeserialization"))) { ++ throw new UnsupportedOperationException( ++ "Deserialization of ex:serializable objects is vulnerable to " + ++ "remote execution attacks and is disabled by default. " + ++ "If you are sure the source data is trusted, you can enable " + ++ "it by setting org.apache.xmlrpc.allowInsecureDeserialization " + ++ "JVM property to 1"); ++ } + try { + byte[] res = (byte[]) super.getResult(); + ByteArrayInputStream bais = new ByteArrayInputStream(res); +diff --git a/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java b/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java +index 16699a6..6ad4b5e 100644 +--- a/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java ++++ b/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java +@@ -805,34 +805,6 @@ public class BaseTest extends XmlRpcTestCase { + assertTrue(ok); + } + +- /** Test, whether we can invoke a method, passing an instance of +- * {@link java.io.Serializable} as a parameter. +- * @throws Exception The test failed. +- */ +- public void testSerializableParam() throws Exception { +- for (int i = 0; i < providers.length; i++) { +- testSerializableParam(providers[i]); +- } +- } +- +- private void testSerializableParam(ClientProvider pProvider) throws Exception { +- final String methodName = "Remote.serializableParam"; +- Calendar cal = Calendar.getInstance(TimeZone.getTimeZone("GMT")); +- cal.set(2005, 5, 23, 8, 4, 0); +- cal.set(Calendar.MILLISECOND, 5); +- final Object[] params = new Object[]{new Remote.CalendarWrapper(cal)}; +- final XmlRpcClient client = pProvider.getClient(); +- Object result = client.execute(getExConfig(pProvider), methodName, params); +- assertEquals(new Long(cal.getTime().getTime()), result); +- boolean ok = false; +- try { +- client.execute(getConfig(pProvider), methodName, params); +- } catch (XmlRpcExtensionException e) { +- ok = true; +- } +- assertTrue(ok); +- } +- + /** Tests, whether we can invoke a method, passing an instance of + * {@link Calendar} as a parameter. + * @throws Exception The test failed. +-- +2.26.0.rc2 + diff --git a/xmlrpc-disallow-loading-external-dtd.patch b/0004-disallow-loading-external-dtd.patch similarity index 81% rename from xmlrpc-disallow-loading-external-dtd.patch rename to 0004-disallow-loading-external-dtd.patch index f59b9c0..f522b77 100644 --- a/xmlrpc-disallow-loading-external-dtd.patch +++ b/0004-disallow-loading-external-dtd.patch @@ -1,7 +1,7 @@ -From 338ab231b228bd36afda4ab31db724c6669579b2 Mon Sep 17 00:00:00 2001 -From: Michael Simacek -Date: Tue, 22 May 2018 10:53:28 +0200 -Subject: [PATCH 2/2] Disallow loading external DTD +From 2c16d38ab18039327b2575f61c3035683f16cd7d Mon Sep 17 00:00:00 2001 +From: Mat Booth +Date: Tue, 31 Mar 2020 17:02:12 +0100 +Subject: [PATCH 4/6] disallow loading external dtd --- .../src/main/java/org/apache/xmlrpc/util/SAXParsers.java | 7 +++++++ @@ -26,5 +26,5 @@ index b1034e7..49ef5de 100644 /** Creates a new instance of {@link XMLReader}. -- -2.17.0 +2.26.0.rc2 diff --git a/0005-Remove-dep-on-ancient-commons-httpclient.patch b/0005-Remove-dep-on-ancient-commons-httpclient.patch new file mode 100644 index 0000000..1629c5a --- /dev/null +++ b/0005-Remove-dep-on-ancient-commons-httpclient.patch @@ -0,0 +1,466 @@ +From 77f696a95873c6bd8cac9254579838db556044a6 Mon Sep 17 00:00:00 2001 +From: Mat Booth +Date: Tue, 31 Mar 2020 17:18:53 +0100 +Subject: [PATCH 5/6] Remove dep on ancient commons httpclient + +--- + client/pom.xml | 4 - + .../xmlrpc/client/XmlRpcCommonsTransport.java | 262 ------------------ + .../client/XmlRpcCommonsTransportFactory.java | 66 ----- + pom.xml | 6 - + server/pom.xml | 5 - + .../apache/xmlrpc/test/CommonsProvider.java | 41 --- + .../apache/xmlrpc/test/XmlRpcTestCase.java | 1 - + 7 files changed, 385 deletions(-) + delete mode 100644 client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java + delete mode 100644 client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java + delete mode 100644 server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java + +diff --git a/client/pom.xml b/client/pom.xml +index f31b2d2..b78ede0 100644 +--- a/client/pom.xml ++++ b/client/pom.xml +@@ -72,9 +72,5 @@ + xmlrpc-common + 3.1.3 + +- +- commons-httpclient +- commons-httpclient +- + + +diff --git a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java b/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java +deleted file mode 100644 +index 1e60ceb..0000000 +--- a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java ++++ /dev/null +@@ -1,262 +0,0 @@ +-/* +- * Licensed to the Apache Software Foundation (ASF) under one +- * or more contributor license agreements. See the NOTICE file +- * distributed with this work for additional information +- * regarding copyright ownership. The ASF licenses this file +- * to you under the Apache License, Version 2.0 (the +- * "License"); you may not use this file except in compliance +- * with the License. You may obtain a copy of the License at +- * +- * http://www.apache.org/licenses/LICENSE-2.0 +- * +- * Unless required by applicable law or agreed to in writing, +- * software distributed under the License is distributed on an +- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +- * KIND, either express or implied. See the License for the +- * specific language governing permissions and limitations +- * under the License. +- */ +-package org.apache.xmlrpc.client; +- +-import java.io.BufferedOutputStream; +-import java.io.FilterOutputStream; +-import java.io.IOException; +-import java.io.InputStream; +-import java.io.OutputStream; +- +-import org.apache.commons.httpclient.Credentials; +-import org.apache.commons.httpclient.Header; +-import org.apache.commons.httpclient.HttpClient; +-import org.apache.commons.httpclient.HttpException; +-import org.apache.commons.httpclient.HttpMethod; +-import org.apache.commons.httpclient.HttpStatus; +-import org.apache.commons.httpclient.HttpVersion; +-import org.apache.commons.httpclient.URI; +-import org.apache.commons.httpclient.URIException; +-import org.apache.commons.httpclient.UsernamePasswordCredentials; +-import org.apache.commons.httpclient.auth.AuthScope; +-import org.apache.commons.httpclient.methods.PostMethod; +-import org.apache.commons.httpclient.methods.RequestEntity; +-import org.apache.commons.httpclient.params.HttpMethodParams; +-import org.apache.xmlrpc.XmlRpcException; +-import org.apache.xmlrpc.XmlRpcRequest; +-import org.apache.xmlrpc.common.XmlRpcStreamConfig; +-import org.apache.xmlrpc.common.XmlRpcStreamRequestConfig; +-import org.apache.xmlrpc.util.HttpUtil; +-import org.apache.xmlrpc.util.XmlRpcIOException; +-import org.xml.sax.SAXException; +- +- +-/** An HTTP transport factory, which is based on the Jakarta Commons +- * HTTP Client. +- */ +-public class XmlRpcCommonsTransport extends XmlRpcHttpTransport { +- /** +- * Maximum number of allowed redirects. +- */ +- private static final int MAX_REDIRECT_ATTEMPTS = 100; +- +- protected final HttpClient client; +- private static final String userAgent = USER_AGENT + " (Jakarta Commons httpclient Transport)"; +- protected PostMethod method; +- private int contentLength = -1; +- private XmlRpcHttpClientConfig config; +- +- /** Creates a new instance. +- * @param pFactory The factory, which created this transport. +- */ +- public XmlRpcCommonsTransport(XmlRpcCommonsTransportFactory pFactory) { +- super(pFactory.getClient(), userAgent); +- HttpClient httpClient = pFactory.getHttpClient(); +- if (httpClient == null) { +- httpClient = newHttpClient(); +- } +- client = httpClient; +- } +- +- protected void setContentLength(int pLength) { +- contentLength = pLength; +- } +- +- protected HttpClient newHttpClient() { +- return new HttpClient(); +- } +- +- protected void initHttpHeaders(XmlRpcRequest pRequest) throws XmlRpcClientException { +- config = (XmlRpcHttpClientConfig) pRequest.getConfig(); +- method = newPostMethod(config); +- super.initHttpHeaders(pRequest); +- +- if (config.getConnectionTimeout() != 0) +- client.getHttpConnectionManager().getParams().setConnectionTimeout(config.getConnectionTimeout()); +- +- if (config.getReplyTimeout() != 0) +- client.getHttpConnectionManager().getParams().setSoTimeout(config.getReplyTimeout()); +- +- method.getParams().setVersion(HttpVersion.HTTP_1_1); +- } +- +- protected PostMethod newPostMethod(XmlRpcHttpClientConfig pConfig) { +- return new PostMethod(pConfig.getServerURL().toString()); +- } +- +- protected void setRequestHeader(String pHeader, String pValue) { +- method.setRequestHeader(new Header(pHeader, pValue)); +- } +- +- protected boolean isResponseGzipCompressed() { +- Header h = method.getResponseHeader( "Content-Encoding" ); +- if (h == null) { +- return false; +- } else { +- return HttpUtil.isUsingGzipEncoding(h.getValue()); +- } +- } +- +- protected InputStream getInputStream() throws XmlRpcException { +- try { +- checkStatus(method); +- return method.getResponseBodyAsStream(); +- } catch (HttpException e) { +- throw new XmlRpcClientException("Error in HTTP transport: " + e.getMessage(), e); +- } catch (IOException e) { +- throw new XmlRpcClientException("I/O error in server communication: " + e.getMessage(), e); +- } +- } +- +- protected void setCredentials(XmlRpcHttpClientConfig pConfig) throws XmlRpcClientException { +- String userName = pConfig.getBasicUserName(); +- if (userName != null) { +- String enc = pConfig.getBasicEncoding(); +- if (enc == null) { +- enc = XmlRpcStreamConfig.UTF8_ENCODING; +- } +- client.getParams().setParameter(HttpMethodParams.CREDENTIAL_CHARSET, enc); +- Credentials creds = new UsernamePasswordCredentials(userName, pConfig.getBasicPassword()); +- AuthScope scope = new AuthScope(null, AuthScope.ANY_PORT, null, AuthScope.ANY_SCHEME); +- client.getState().setCredentials(scope, creds); +- client.getParams().setAuthenticationPreemptive(true); +- } +- } +- +- protected void close() throws XmlRpcClientException { +- method.releaseConnection(); +- } +- +- protected boolean isResponseGzipCompressed(XmlRpcStreamRequestConfig pConfig) { +- Header h = method.getResponseHeader( "Content-Encoding" ); +- if (h == null) { +- return false; +- } else { +- return HttpUtil.isUsingGzipEncoding(h.getValue()); +- } +- } +- +- protected boolean isRedirectRequired() { +- switch (method.getStatusCode()) { +- case HttpStatus.SC_MOVED_TEMPORARILY: +- case HttpStatus.SC_MOVED_PERMANENTLY: +- case HttpStatus.SC_SEE_OTHER: +- case HttpStatus.SC_TEMPORARY_REDIRECT: +- return true; +- default: +- return false; +- } +- } +- +- protected void resetClientForRedirect() +- throws XmlRpcException { +- //get the location header to find out where to redirect to +- Header locationHeader = method.getResponseHeader("location"); +- if (locationHeader == null) { +- throw new XmlRpcException("Invalid redirect: Missing location header"); +- } +- String location = locationHeader.getValue(); +- +- URI redirectUri = null; +- URI currentUri = null; +- try { +- currentUri = method.getURI(); +- String charset = currentUri.getProtocolCharset(); +- redirectUri = new URI(location, true, charset); +- method.setURI(redirectUri); +- } catch (URIException ex) { +- throw new XmlRpcException(ex.getMessage(), ex); +- } +- +- //And finally invalidate the actual authentication scheme +- method.getHostAuthState().invalidate(); +- } +- +- protected void writeRequest(final ReqWriter pWriter) throws XmlRpcException { +- method.setRequestEntity(new RequestEntity(){ +- public boolean isRepeatable() { return true; } +- public void writeRequest(OutputStream pOut) throws IOException { +- try { +- /* Make sure, that the socket is not closed by replacing it with our +- * own BufferedOutputStream. +- */ +- OutputStream ostream; +- if (isUsingByteArrayOutput(config)) { +- // No need to buffer the output. +- ostream = new FilterOutputStream(pOut){ +- public void close() throws IOException { +- flush(); +- } +- }; +- } else { +- ostream = new BufferedOutputStream(pOut){ +- public void close() throws IOException { +- flush(); +- } +- }; +- } +- pWriter.write(ostream); +- } catch (XmlRpcException e) { +- throw new XmlRpcIOException(e); +- } catch (SAXException e) { +- throw new XmlRpcIOException(e); +- } +- } +- public long getContentLength() { return contentLength; } +- public String getContentType() { return "text/xml"; } +- }); +- try { +- int redirectAttempts = 0; +- for (;;) { +- client.executeMethod(method); +- if (!isRedirectRequired()) { +- break; +- } +- if (redirectAttempts++ > MAX_REDIRECT_ATTEMPTS) { +- throw new XmlRpcException("Too many redirects."); +- } +- resetClientForRedirect(); +- } +- } catch (XmlRpcIOException e) { +- Throwable t = e.getLinkedException(); +- if (t instanceof XmlRpcException) { +- throw (XmlRpcException) t; +- } else { +- throw new XmlRpcException("Unexpected exception: " + t.getMessage(), t); +- } +- } catch (IOException e) { +- throw new XmlRpcException("I/O error while communicating with HTTP server: " + e.getMessage(), e); +- } +- } +- +- /** +- * Check the status of the HTTP request and throw an XmlRpcHttpTransportException if it +- * indicates that there is an error. +- * @param pMethod the method that has been executed +- * @throws XmlRpcHttpTransportException if the status of the method indicates that there is an error. +- */ +- private void checkStatus(HttpMethod pMethod) throws XmlRpcHttpTransportException { +- final int status = pMethod.getStatusCode(); +- +- // All status codes except SC_OK are handled as errors. Perhaps some should require special handling (e.g., SC_UNAUTHORIZED) +- if (status < 200 || status > 299) { +- throw new XmlRpcHttpTransportException(status, pMethod.getStatusText()); +- } +- } +-} +diff --git a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java b/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java +deleted file mode 100644 +index 630d5b4..0000000 +--- a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java ++++ /dev/null +@@ -1,66 +0,0 @@ +-/* +- * Licensed to the Apache Software Foundation (ASF) under one +- * or more contributor license agreements. See the NOTICE file +- * distributed with this work for additional information +- * regarding copyright ownership. The ASF licenses this file +- * to you under the Apache License, Version 2.0 (the +- * "License"); you may not use this file except in compliance +- * with the License. You may obtain a copy of the License at +- * +- * http://www.apache.org/licenses/LICENSE-2.0 +- * +- * Unless required by applicable law or agreed to in writing, +- * software distributed under the License is distributed on an +- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +- * KIND, either express or implied. See the License for the +- * specific language governing permissions and limitations +- * under the License. +- */ +-package org.apache.xmlrpc.client; +- +-import org.apache.commons.httpclient.HttpClient; +- +- +-/** An HTTP transport factory, which is based on the Jakarta Commons +- * HTTP Client. +- */ +-public class XmlRpcCommonsTransportFactory extends XmlRpcTransportFactoryImpl { +- private HttpClient httpClient; +- +- /** Creates a new instance. +- * @param pClient The client, which is controlling the factory. +- */ +- public XmlRpcCommonsTransportFactory(XmlRpcClient pClient) { +- super(pClient); +- } +- +- public XmlRpcTransport getTransport() { +- return new XmlRpcCommonsTransport(this); +- } +- +- /** +- *

Sets the factories {@link HttpClient}. By default, a new instance +- * of {@link HttpClient} is created for any request.

+- *

Reusing the {@link HttpClient} is required, if you want to preserve +- * some state between requests. This applies, in particular, if you want +- * to use cookies: In that case, create an instance of {@link HttpClient}, +- * give it to the factory, and use {@link HttpClient#getState()} to +- * read or set cookies. +- */ +- public void setHttpClient(HttpClient pHttpClient) { +- httpClient = pHttpClient; +- } +- +- /** +- *

Returns the factories {@link HttpClient}. By default, a new instance +- * of {@link HttpClient} is created for any request.

+- *

Reusing the {@link HttpClient} is required, if you want to preserve +- * some state between requests. This applies, in particular, if you want +- * to use cookies: In that case, create an instance of {@link HttpClient}, +- * give it to the factory, and use {@link HttpClient#getState()} to +- * read or set cookies. +- */ +- public HttpClient getHttpClient() { +- return httpClient; +- } +-} +diff --git a/pom.xml b/pom.xml +index 5e18625..55cc6a8 100644 +--- a/pom.xml ++++ b/pom.xml +@@ -321,12 +321,6 @@ + + + +- +- commons-httpclient +- commons-httpclient +- 3.0.1 +- provided +- + + commons-logging + commons-logging +diff --git a/server/pom.xml b/server/pom.xml +index 4c90e50..84234ff 100644 +--- a/server/pom.xml ++++ b/server/pom.xml +@@ -95,10 +95,5 @@ + javax.servlet + javax.servlet-api + +- +- commons-httpclient +- commons-httpclient +- test +- + + +diff --git a/server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java b/server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java +deleted file mode 100644 +index 2551a59..0000000 +--- a/server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java ++++ /dev/null +@@ -1,41 +0,0 @@ +-/* +- * Licensed to the Apache Software Foundation (ASF) under one +- * or more contributor license agreements. See the NOTICE file +- * distributed with this work for additional information +- * regarding copyright ownership. The ASF licenses this file +- * to you under the Apache License, Version 2.0 (the +- * "License"); you may not use this file except in compliance +- * with the License. You may obtain a copy of the License at +- * +- * http://www.apache.org/licenses/LICENSE-2.0 +- * +- * Unless required by applicable law or agreed to in writing, +- * software distributed under the License is distributed on an +- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +- * KIND, either express or implied. See the License for the +- * specific language governing permissions and limitations +- * under the License. +- */ +-package org.apache.xmlrpc.test; +- +-import org.apache.xmlrpc.client.XmlRpcClient; +-import org.apache.xmlrpc.client.XmlRpcCommonsTransportFactory; +-import org.apache.xmlrpc.client.XmlRpcTransportFactory; +-import org.apache.xmlrpc.server.XmlRpcHandlerMapping; +- +- +-/** Provider for testing the +- * {@link org.apache.xmlrpc.client.XmlRpcCommonsTransport}. +- */ +-public class CommonsProvider extends WebServerProvider { +- /** Creates a new instance. +- * @param pMapping The test servers handler mapping. +- */ +- public CommonsProvider(XmlRpcHandlerMapping pMapping) { +- super(pMapping, true); +- } +- +- protected XmlRpcTransportFactory getTransportFactory(XmlRpcClient pClient) { +- return new XmlRpcCommonsTransportFactory(pClient); +- } +-} +diff --git a/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java b/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java +index a9d1fbf..de06406 100644 +--- a/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java ++++ b/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java +@@ -75,7 +75,6 @@ public abstract class XmlRpcTestCase extends TestCase { + // new LiteTransportProvider(mapping, false), Doesn't support HTTP/1.1 + new SunHttpTransportProvider(pMapping, true), + new SunHttpTransportProvider(pMapping, false), +- new CommonsProvider(pMapping), + new ServletWebServerProvider(pMapping, true), + new ServletWebServerProvider(pMapping, false) + }; +-- +2.26.0.rc2 + diff --git a/0006-Fix-for-CVE-2019-17570.patch b/0006-Fix-for-CVE-2019-17570.patch new file mode 100644 index 0000000..8a93dc5 --- /dev/null +++ b/0006-Fix-for-CVE-2019-17570.patch @@ -0,0 +1,52 @@ +From 1594395df534d60133d98884c9d9f5eb92d0652e Mon Sep 17 00:00:00 2001 +From: Mat Booth +Date: Wed, 1 Apr 2020 10:21:03 +0100 +Subject: [PATCH 6/6] Fix for CVE-2019-17570 + +Deserialization of server-side exception from faultCause in XMLRPC error response +--- + .../xmlrpc/parser/XmlRpcResponseParser.java | 28 ++++++++++--------- + 1 file changed, 15 insertions(+), 13 deletions(-) + +diff --git a/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java b/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java +index 087572b..f1b2427 100644 +--- a/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java ++++ b/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java +@@ -69,19 +69,21 @@ public class XmlRpcResponseParser extends RecursiveTypeParserImpl { + getDocumentLocator()); + } + errorMessage = (String) map.get("faultString"); +- Object exception = map.get("faultCause"); +- if (exception != null) { +- try { +- byte[] bytes = (byte[]) exception; +- ByteArrayInputStream bais = new ByteArrayInputStream(bytes); +- ObjectInputStream ois = new ObjectInputStream(bais); +- errorCause = (Throwable) ois.readObject(); +- ois.close(); +- bais.close(); +- } catch (Throwable t) { +- // Ignore me +- } +- } ++ if (((XmlRpcStreamRequestConfig)cfg).isEnabledForExceptions()) { ++ Object exception = map.get("faultCause"); ++ if (exception != null) { ++ try { ++ byte[] bytes = (byte[]) exception; ++ ByteArrayInputStream bais = new ByteArrayInputStream(bytes); ++ ObjectInputStream ois = new ObjectInputStream(bais); ++ errorCause = (Throwable) ois.readObject(); ++ ois.close(); ++ bais.close(); ++ } catch (Throwable t) { ++ // Ignore me ++ } ++ } ++ } + } + } + +-- +2.26.0.rc2 + diff --git a/changelog-pre3.x.txt b/changelog-pre3.x.txt deleted file mode 100644 index 9cef632..0000000 --- a/changelog-pre3.x.txt +++ /dev/null @@ -1,120 +0,0 @@ -* Sun Jul 22 2012 Fedora Release Engineering - 0:2.0.1-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Tue Jun 05 2012 Stanislav Ochotnicky - 0:2.0.1-12 -- Migrate to new tomcat-servlet-api - -* Sat Jan 14 2012 Fedora Release Engineering - 0:2.0.1-11 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild - -* Mon Feb 07 2011 Fedora Release Engineering - 0:2.0.1-10 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Tue Dec 21 2010 Stanislav Ochotnicky - 0:2.0.1-9 -- Require java >= 1:1.6.0 -- Fix classpaths to ensure building of all optional features -- Remove stale patch - -* Thu Dec 16 2010 Stanislav Ochotnicky - 0:2.0.1-8 -- Migrate from old servlet api to new one - -* Thu Dec 9 2010 Stanislav Ochotnicky - 0:2.0.1-7 -- Remove gcj support -- Make jars/javadocs versionless -- Add ws-commons-util Requires -- Use apache-commons-codec -- Drop unneeded patch for jsse - -* Thu Mar 11 2010 Peter Lemenkov - 0:2.0.1-6.6 -- Added missing requires jpackage-utils - -* Mon Jul 27 2009 Fedora Release Engineering - 0:2.0.1-6.5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Thu Feb 26 2009 Fedora Release Engineering - 0:2.0.1-5.5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild - -* Thu Jul 10 2008 Tom "spot" Callaway - 0:2.0.1-4.5 -- drop repotag - -* Thu May 29 2008 Tom "spot" Callaway - 0:2.0.1-4jpp.4 -- fix license tag - -* Tue Feb 19 2008 Fedora Release Engineering - 0:2.0.1-4jpp.3 -- Autorebuild for GCC 4.3 - -* Tue Mar 27 2007 Matt Wringe 0:2.0.1-3jpp.3 -- Spec file clean up for Fedora Extras Review - -* Thu Mar 08 2007 Deepak Bhole 2.0.1-3jpp.2 -- Add javax.net.ssl support to build org.apache.xmlrpc.secure.* -- Minor spec file cleanup - -* Fri Aug 04 2006 Vivek Lakshmanan - 0:2.0.1-3jpp.1 -- Merge with latest from JPP. - -* Sat Jul 22 2006 Jakub Jelinek - 0:2.0.1-1jpp_8.2fc -- Rebuilt - -* Wed Jul 12 2006 Jesse Keating - 0:2.0.1-1jpp_8.1fc -- rebuild - -* Wed Mar 8 2006 Rafael Schloming - 0:2.0.1-1jpp_7fc -- excluded s390 due to eclipse - -* Mon Mar 6 2006 Jeremy Katz - 0:2.0.1-1jpp_6fc -- stop scriptlet spew - -* Fri Feb 24 2006 Igor Foox - 0:2.0.1-1jpp_5fc -- Added post/postun dependency on coreutils. - -* Fri Feb 10 2006 Jesse Keating - 0:2.0.1-1jpp_4fc -- bump again for double-long bug on ppc(64) - -* Tue Feb 07 2006 Jesse Keating - 0:2.0.1-1jpp_3fc -- rebuilt for new gcc4.1 snapshot and glibc changes - -* Wed Jan 25 2006 Igor Foox 0:2.0.1-1jpp_2fc -- ExcludeArch s390x and ppc64 - -* Wed Jan 18 2006 Andrew Overholt 0:2.0.1-1jpp_2fc -- Comment out JPackage Distribution and Vendor tags - -* Wed Jan 18 2006 Jesse Keating 0:2.0.1-1jpp_2fc -- bump for test - -* Wed Jan 18 2006 Igor Foox 0:2.0.1-1jpp_1fc -- Update to version 2.0.1 -- Natively compile - -* Thu Aug 26 2004 Ralph Apel 0:1.2-0.b1.3jpp -- Build with ant-1.6.2 - -* Thu Apr 29 2004 David Walluck 0:1.2-0.b1.2jpp -- add jar symlinks -- remove %%buildroot in %%install - -* Tue May 06 2003 David Walluck 0:1.2-0.b1.1jpp -- 1.2-b1 -- update for JPackage 1.5 - -* Mon Mar 18 2002 Guillaume Rousse 1.1-1jpp -- 1.1 -- generic servlet support -- used source release -- dropped patch -- added applet jar - -* Mon Jan 21 2002 Guillaume Rousse 1.0-3jpp -- versioned dir for javadoc -- no dependencies for javadoc package -- dropped jsse package -- adaptation to new servlet3 package -- adaptation to new jsse package -- section macro - -* Fri Dec 7 2001 Guillaume Rousse 1.0-2jpp -- javadoc into javadoc package - -* Sat Nov 3 2001 Guillaume Rousse 1.0-1jpp -- first JPackage release diff --git a/xmlrpc-client-addosgimanifest.patch b/xmlrpc-client-addosgimanifest.patch deleted file mode 100644 index 437d78f..0000000 --- a/xmlrpc-client-addosgimanifest.patch +++ /dev/null @@ -1,20 +0,0 @@ ---- pom.xml.sav 2010-02-06 17:44:57.000000000 +0200 -+++ pom.xml 2010-09-29 09:27:06.194857352 +0300 -@@ -48,6 +48,17 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 2 -+ %Bundle-Name -+ plugin -+ org.apache.xmlrpc -+ ${project.version} -+ org.apache.xmlrpc.common -+ org.apache.xmlrpc, org.apache.xmlrpc.client, org.apache.xmlrpc.client.util -+ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers -+ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 -+ dependent -+ %Bundle-Vendor.0 - - - diff --git a/xmlrpc-common-addosgimanifest.patch b/xmlrpc-common-addosgimanifest.patch deleted file mode 100644 index 4d4aeca..0000000 --- a/xmlrpc-common-addosgimanifest.patch +++ /dev/null @@ -1,19 +0,0 @@ ---- pom.xml.sav 2010-02-06 17:44:50.000000000 +0200 -+++ pom.xml 2010-09-29 09:30:38.857857644 +0300 -@@ -48,6 +48,16 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 2 -+ %Bundle-Name -+ plugin -+ org.apache.xmlrpc.common -+ ${project.version} -+ org.apache.xmlrpc, org.apache.xmlrpc.common, org.apache.xmlrpc.jaxb, org.apache.xmlrpc.parser, org.apache.xmlrpc.serializer, org.apache.xmlrpc.util -+ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers -+ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 -+ dependent -+ %Bundle-Vendor.0 - - - diff --git a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch b/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch deleted file mode 100644 index 53a0a98..0000000 --- a/xmlrpc-disallow-deserialization-of-ex-serializable-tags.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 495d6136d9de5c0bbddadffe11b0841c6aafcb34 Mon Sep 17 00:00:00 2001 -From: Michael Simacek -Date: Fri, 18 May 2018 15:22:49 +0200 -Subject: [PATCH 1/2] Disallow deserialization of tags - -Can be reenabled by setting JVM property -org.apache.xmlrpc.allowInsecureDeserialization to 1. - -- Resolves CVE-2016-5003 ---- - .../java/org/apache/xmlrpc/parser/SerializableParser.java | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -index 18f25ac..c8bb7ed 100644 ---- a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -+++ b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -@@ -29,6 +29,14 @@ import org.apache.xmlrpc.XmlRpcException; - */ - public class SerializableParser extends ByteArrayParser { - public Object getResult() throws XmlRpcException { -+ if (!"1".equals(System.getProperty("org.apache.xmlrpc.allowInsecureDeserialization"))) { -+ throw new UnsupportedOperationException( -+ "Deserialization of ex:serializable objects is vulnerable to " + -+ "remote execution attacks and is disabled by default. " + -+ "If you are sure the source data is trusted, you can enable " + -+ "it by setting org.apache.xmlrpc.allowInsecureDeserialization " + -+ "JVM property to 1"); -+ } - try { - byte[] res = (byte[]) super.getResult(); - ByteArrayInputStream bais = new ByteArrayInputStream(res); --- -2.17.0 - diff --git a/xmlrpc-server-addosgimanifest.patch b/xmlrpc-server-addosgimanifest.patch deleted file mode 100644 index af54e20..0000000 --- a/xmlrpc-server-addosgimanifest.patch +++ /dev/null @@ -1,15 +0,0 @@ ---- pom.xml 2014-07-07 11:24:52.668887604 -0400 -+++ pom.xml.sav 2014-07-07 11:25:06.174916380 -0400 -@@ -48,6 +48,12 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 1 -+ %Bundle-Name -+ org.apache.xmlrpc.server -+ ${project.version} -+ org.apache.xmlrpc.common -+ org.apache.xmlrpc.server,org.apache.xmlrpc.webserver - - - diff --git a/xmlrpc.spec b/xmlrpc.spec index c430286..a2cb5e6 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,79 +1,71 @@ Name: xmlrpc Version: 3.1.3 -Release: 22%{?dist} +Release: 24%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 -URL: http://ws.apache.org/xmlrpc/ +URL: https://ws.apache.org/xmlrpc/ BuildArch: noarch -Source0: http://www.apache.org/dist/ws/xmlrpc/sources/apache-xmlrpc-%{version}-src.tar.bz2 -Patch0: %{name}-client-addosgimanifest.patch -Patch1: %{name}-common-addosgimanifest.patch -Patch2: %{name}-javax-methods.patch -Patch3: %{name}-server-addosgimanifest.patch -Patch4: %{name}-disallow-deserialization-of-ex-serializable-tags.patch -Patch5: %{name}-disallow-loading-external-dtd.patch +Source0: https://archive.apache.org/dist/ws/xmlrpc/sources/apache-xmlrpc-%{version}-src.tar.bz2 + +# Fix build against modern servlet API by implementing missing interfaces +Patch0: 0001-Javax-Servlet-API.patch +# Add OSGi metadata so that xmlrpc can be used in OSGi runtimes +Patch1: 0002-Add-OSGi-metadata.patch +# CVE-2016-5003 - Disallow deserialization of tags by default +Patch2: 0003-disallow-deserialization-of-ex-serializable-tags.patch +# CVE-2016-5002 - isallow loading of external DTD +Patch3: 0004-disallow-loading-external-dtd.patch +# Jakarta Commons HttpClient is obsolete and should not be used, one of the other +# provider implementations should by used instead by clients of xmlrpc +Patch4: 0005-Remove-dep-on-ancient-commons-httpclient.patch +# CVE-2019-17570 - Deserialization of server-side exception from faultCause in XMLRPC error response +Patch5: 0006-Fix-for-CVE-2019-17570.patch BuildRequires: maven-local -BuildRequires: mvn(org.apache:apache:pom:) -BuildRequires: mvn(commons-httpclient:commons-httpclient) BuildRequires: mvn(commons-logging:commons-logging) -BuildRequires: mvn(javax.servlet:servlet-api) +BuildRequires: mvn(javax.servlet:javax.servlet-api) +BuildRequires: mvn(junit:junit) +BuildRequires: mvn(org.apache:apache:pom:) BuildRequires: mvn(org.apache.ws.commons.util:ws-commons-util) %description Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. -Apache XML-RPC was previously known as Helma XML-RPC. If you have code -using the Helma library, all you should have to do is change the import -statements in your code from helma.xmlrpc.* to org.apache.xmlrpc.*. %package javadoc -Summary: Javadoc for %{name} +Summary: Javadoc for %{name} %description javadoc Javadoc for %{name}. %package common -Summary: Common classes for XML-RPC client and server implementations -# Provide xmlrpc is not here because it would be useless due to different jar names -Obsoletes: %{name} < 3.1.3 -Obsoletes: %{name}3-common < 3.1.3-13 -Provides: %{name}3-common = 3.1.3-13 +Summary: Common classes for XML-RPC client and server implementations %description common %{summary}. %package client -Summary: XML-RPC client implementation -Obsoletes: %{name}3-client < 3.1.3-13 -Provides: %{name}3-client = 3.1.3-13 +Summary: XML-RPC client implementation %description client %{summary}. %package server -Summary: XML-RPC server implementation -Obsoletes: %{name}3-server < 3.1.3-13 -Provides: %{name}3-server = 3.1.3-13 +Summary: XML-RPC server implementation %description server %{summary}. %prep %setup -q -n apache-%{name}-%{version}-src + +%patch0 -p1 +%patch1 -p1 %patch2 -p1 -pushd client -%patch0 -b .sav -popd -pushd common -%patch1 -b .sav -popd -pushd server -%patch3 -b .sav -popd +%patch3 -p1 %patch4 -p1 %patch5 -p1 @@ -81,14 +73,13 @@ sed -i 's/\r//' LICENSE.txt %pom_disable_module dist %pom_remove_dep jaxme:jaxmeapi common -# This dep is no longer supplied by ws-commons-util %pom_add_dep junit:junit:3.8.1:test %mvn_file :{*} @1 %mvn_package :*-common %{name} %build -# FIXME: ignore test failure because server part needs network +# ignore test failure because server part needs network %mvn_build -s -- -Dmaven.test.failure.ignore=true %install @@ -105,6 +96,12 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Wed Apr 01 2020 Mat Booth - 1:3.1.3-24 +- Add patch for CVE-2019-17570 + +* Tue Mar 31 2020 Mat Booth - 1:3.1.3-23 +- Modernise spec file and remove dep on ancient Jakarta Commons httpclient implementation + * Sun Feb 03 2019 Fedora Release Engineering - 1:3.1.3-22 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild From 9a53def233560d4164183ce93506acd529e4d234 Mon Sep 17 00:00:00 2001 From: Mat Booth Date: Fri, 19 Jun 2020 18:23:09 +0100 Subject: [PATCH 16/20] Allow building on Java 11 --- xmlrpc.spec | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index a2cb5e6..1e3306a 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 24%{?dist} +Release: 25%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -26,11 +26,11 @@ Patch5: 0006-Fix-for-CVE-2019-17570.patch BuildRequires: maven-local BuildRequires: mvn(commons-logging:commons-logging) BuildRequires: mvn(javax.servlet:javax.servlet-api) +BuildRequires: mvn(javax.xml.bind:jaxb-api) BuildRequires: mvn(junit:junit) BuildRequires: mvn(org.apache:apache:pom:) BuildRequires: mvn(org.apache.ws.commons.util:ws-commons-util) - %description Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol that uses XML over HTTP to implement remote procedure calls. @@ -75,12 +75,22 @@ sed -i 's/\r//' LICENSE.txt %pom_remove_dep jaxme:jaxmeapi common %pom_add_dep junit:junit:3.8.1:test +%pom_remove_plugin :maven-javadoc-plugin + +# Add missing dep when building against Java 11 +%pom_add_dep javax.xml.bind:jaxb-api:2.2.12 + +# don't hard code source and target levels +sed -i -e '//d' \ + -e '//d' pom.xml + %mvn_file :{*} @1 %mvn_package :*-common %{name} %build # ignore test failure because server part needs network -%mvn_build -s -- -Dmaven.test.failure.ignore=true +%mvn_build -s -- -Dmaven.test.failure.ignore=true \ + -Dmaven.compiler.source=1.8 -Dmaven.compiler.target=1.8 %install %mvn_install @@ -96,6 +106,9 @@ sed -i 's/\r//' LICENSE.txt %license LICENSE.txt NOTICE.txt %changelog +* Fri Jun 19 2020 Mat Booth - 1:3.1.3-25 +- Allow building on Java 11 + * Wed Apr 01 2020 Mat Booth - 1:3.1.3-24 - Add patch for CVE-2019-17570 From f04a8fedebde92d29f7af9c9e6b59537a09e90ac Mon Sep 17 00:00:00 2001 From: Jiri Date: Sat, 11 Jul 2020 08:54:01 +0200 Subject: [PATCH 17/20] Rebuilt for JDK-11 --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index 1e3306a..5a6e52e 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 25%{?dist} +Release: 26%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -106,6 +106,9 @@ sed -i -e '//d' \ %license LICENSE.txt NOTICE.txt %changelog +* Sat Jul 11 2020 Jiri Vanek - 1:3.1.3-26 +- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 + * Fri Jun 19 2020 Mat Booth - 1:3.1.3-25 - Allow building on Java 11 From ef5530c5cb7dbd4fb26ffae5f66949710704a18a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 29 Jul 2020 14:50:36 +0000 Subject: [PATCH 18/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index 5a6e52e..b0d097b 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 26%{?dist} +Release: 27%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -106,6 +106,9 @@ sed -i -e '//d' \ %license LICENSE.txt NOTICE.txt %changelog +* Wed Jul 29 2020 Fedora Release Engineering - 1:3.1.3-27 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + * Sat Jul 11 2020 Jiri Vanek - 1:3.1.3-26 - Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 From efe7a3a395aa2ad69e370767008bb008a0642edb Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 28 Jan 2021 00:09:58 +0000 Subject: [PATCH 19/20] - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- xmlrpc.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/xmlrpc.spec b/xmlrpc.spec index b0d097b..9a7a795 100644 --- a/xmlrpc.spec +++ b/xmlrpc.spec @@ -1,6 +1,6 @@ Name: xmlrpc Version: 3.1.3 -Release: 27%{?dist} +Release: 28%{?dist} Epoch: 1 Summary: Java XML-RPC implementation License: ASL 2.0 @@ -106,6 +106,9 @@ sed -i -e '//d' \ %license LICENSE.txt NOTICE.txt %changelog +* Thu Jan 28 2021 Fedora Release Engineering - 1:3.1.3-28 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + * Wed Jul 29 2020 Fedora Release Engineering - 1:3.1.3-27 - Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild From b035d35b7e905e395c0c19e37150d550c6b21619 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= Date: Fri, 12 Mar 2021 22:43:11 +0100 Subject: [PATCH 20/20] Orphaned for 6+ weeks --- .gitignore | 2 - .project | 17 - 0001-Javax-Servlet-API.patch | 264 ---------- 0002-Add-OSGi-metadata.patch | 74 --- ...erialization-of-ex-serializable-tags.patch | 71 --- 0004-disallow-loading-external-dtd.patch | 30 -- ...ve-dep-on-ancient-commons-httpclient.patch | 466 ------------------ 0006-Fix-for-CVE-2019-17570.patch | 52 -- dead.package | 1 + sources | 1 - xmlrpc.spec | 197 -------- 11 files changed, 1 insertion(+), 1174 deletions(-) delete mode 100644 .gitignore delete mode 100644 .project delete mode 100644 0001-Javax-Servlet-API.patch delete mode 100644 0002-Add-OSGi-metadata.patch delete mode 100644 0003-disallow-deserialization-of-ex-serializable-tags.patch delete mode 100644 0004-disallow-loading-external-dtd.patch delete mode 100644 0005-Remove-dep-on-ancient-commons-httpclient.patch delete mode 100644 0006-Fix-for-CVE-2019-17570.patch create mode 100644 dead.package delete mode 100644 sources delete mode 100644 xmlrpc.spec diff --git a/.gitignore b/.gitignore deleted file mode 100644 index 6de88cd..0000000 --- a/.gitignore +++ /dev/null @@ -1,2 +0,0 @@ -xmlrpc-2.0.1-src.tar.gz -/apache-xmlrpc-3.1.3-src.tar.bz2 diff --git a/.project b/.project deleted file mode 100644 index d3cdf74..0000000 --- a/.project +++ /dev/null @@ -1,17 +0,0 @@ - - - xmlrpc - - - - - - org.eclipse.linuxtools.rpm.rpmlint.rpmlintBuilder - - - - - - org.eclipse.linuxtools.rpm.rpmlint.rpmlintNature - - diff --git a/0001-Javax-Servlet-API.patch b/0001-Javax-Servlet-API.patch deleted file mode 100644 index c6a4f93..0000000 --- a/0001-Javax-Servlet-API.patch +++ /dev/null @@ -1,264 +0,0 @@ -From a552fe2cd20c9804d9abcbf5f99533ed9c495fe7 Mon Sep 17 00:00:00 2001 -From: Mat Booth -Date: Tue, 31 Mar 2020 16:58:31 +0100 -Subject: [PATCH 1/6] Javax Servlet API - ---- - dist/pom.xml | 2 +- - pom.xml | 4 +- - server/pom.xml | 8 ++- - .../webserver/HttpServletRequestImpl.java | 54 +++++++++++++++++++ - .../webserver/HttpServletResponseImpl.java | 26 ++++++++- - .../webserver/ServletOutputStreamImpl.java | 5 ++ - 6 files changed, 94 insertions(+), 5 deletions(-) - -diff --git a/dist/pom.xml b/dist/pom.xml -index 67aded6..590f750 100644 ---- a/dist/pom.xml -+++ b/dist/pom.xml -@@ -59,7 +59,7 @@ - - - javax.servlet -- servlet-api -+ javax.servlet-api - - - org.apache.xmlrpc -diff --git a/pom.xml b/pom.xml -index 3933da5..5e18625 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -344,8 +344,8 @@ - - - javax.servlet -- servlet-api -- 2.4 -+ javax.servlet-api -+ 3.1.0 - provided - - -diff --git a/server/pom.xml b/server/pom.xml -index 0d09544..6cbc6e7 100644 ---- a/server/pom.xml -+++ b/server/pom.xml -@@ -67,6 +67,12 @@ - - commons-logging - commons-logging -+ -+ -+ javax.servlet -+ servlet-api -+ -+ - - - org.apache.xmlrpc -@@ -81,7 +87,7 @@ - - - javax.servlet -- servlet-api -+ javax.servlet-api - - - commons-httpclient -diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java -index 3dc7e43..19b14a2 100644 ---- a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java -+++ b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletRequestImpl.java -@@ -31,6 +31,7 @@ import java.net.URLDecoder; - import java.security.Principal; - import java.util.ArrayList; - import java.util.Collections; -+import java.util.Collection; - import java.util.Enumeration; - import java.util.HashMap; - import java.util.Iterator; -@@ -39,10 +40,20 @@ import java.util.Locale; - import java.util.Map; - import java.util.StringTokenizer; - -+import javax.servlet.ReadListener; - import javax.servlet.RequestDispatcher; -+import javax.servlet.ServletException; - import javax.servlet.ServletInputStream; -+import javax.servlet.DispatcherType; -+import javax.servlet.AsyncContext; -+import javax.servlet.ServletContext; -+import javax.servlet.ServletRequest; -+import javax.servlet.ServletResponse; - import javax.servlet.http.Cookie; -+import javax.servlet.http.HttpUpgradeHandler; -+import javax.servlet.http.Part; - import javax.servlet.http.HttpServletRequest; -+import javax.servlet.http.HttpServletResponse; - import javax.servlet.http.HttpSession; - - import org.apache.xmlrpc.common.XmlRpcStreamConfig; -@@ -66,6 +77,7 @@ public class HttpServletRequestImpl implements HttpServletRequest { - private String queryString; - private String httpVersion; - private final Map headers = new HashMap(); -+ private final Map parts = new HashMap(); - private final Map attributes = new HashMap(); - private Map parameters; - private String characterEncoding; -@@ -97,6 +109,18 @@ public class HttpServletRequestImpl implements HttpServletRequest { - } - return c; - } -+ -+ public boolean isFinished() { -+ return contentBytesRemaining == 0; -+ } -+ -+ public boolean isReady() { -+ return true; -+ } -+ -+ public void setReadListener(ReadListener arg0) { -+ throw new IllegalStateException("Not implemented."); -+ } - }; - } - -@@ -227,6 +251,12 @@ public class HttpServletRequestImpl implements HttpServletRequest { - return Collections.enumeration(list); - } - -+ public Part getPart(String name) { throw new IllegalStateException("Not implemented"); } -+ -+ public Collection getParts() { throw new IllegalStateException("Not implemented"); } -+ -+ public boolean authenticate (HttpServletResponse response) { throw new IllegalStateException("Not implemented"); } -+ - public int getIntHeader(String pHeader) { - String s = getHeader(pHeader); - return s == null ? -1 : Integer.parseInt(s); -@@ -242,6 +272,10 @@ public class HttpServletRequestImpl implements HttpServletRequest { - - public String getRemoteUser() { throw new IllegalStateException("Not implemented"); } - -+ public void login(String username, String password) { throw new IllegalStateException("Not implemented"); } -+ -+ public void logout() { throw new IllegalStateException("Not implemented"); } -+ - public String getRequestURI() { return uri; } - - public StringBuffer getRequestURL() { -@@ -280,6 +314,20 @@ public class HttpServletRequestImpl implements HttpServletRequest { - return sb; - } - -+ public AsyncContext getAsyncContext() { throw new IllegalStateException("Not implemented"); } -+ -+ public boolean isAsyncSupported() { return false; } -+ -+ public boolean isAsyncStarted() { return false; } -+ -+ public ServletContext getServletContext() { throw new IllegalStateException("Not implemented"); } -+ -+ public AsyncContext startAsync(ServletRequest req, ServletResponse resp) { throw new IllegalStateException("Not implemented"); } -+ -+ public AsyncContext startAsync() { throw new IllegalStateException("Not implemented"); } -+ -+ public DispatcherType getDispatcherType() { throw new IllegalStateException("Not implemented"); } -+ - public String getRequestedSessionId() { throw new IllegalStateException("Not implemented"); } - - public String getServletPath() { return uri; } -@@ -544,4 +592,10 @@ public class HttpServletRequestImpl implements HttpServletRequest { - } - - protected String getHttpVersion() { return httpVersion; } -+ -+ public long getContentLengthLong() { throw new IllegalStateException("Not implemented."); } -+ -+ public String changeSessionId() { throw new IllegalStateException("Not implemented."); } -+ -+ public HttpUpgradeHandler upgrade(Class arg0) { throw new IllegalStateException("Not implemented."); } - } -diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java -index 6ba7018..5319dcf 100644 ---- a/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java -+++ b/server/src/main/java/org/apache/xmlrpc/webserver/HttpServletResponseImpl.java -@@ -29,6 +29,8 @@ import java.util.Iterator; - import java.util.List; - import java.util.Locale; - import java.util.Map; -+import java.util.Collection; -+import java.util.Collections; - import java.util.StringTokenizer; - - import javax.servlet.ServletOutputStream; -@@ -84,7 +86,7 @@ public class HttpServletResponseImpl implements HttpServletResponse { - } - } - -- private String getHeader(String pHeader) { -+ public String getHeader(String pHeader) { - String key = pHeader.toLowerCase(); - Object o = headers.get(key); - if (o == null) { -@@ -101,6 +103,26 @@ public class HttpServletResponseImpl implements HttpServletResponse { - } - } - -+ public Collection getHeaderNames() { -+ return headers.keySet(); -+ } -+ -+ public Collection getHeaders(String pHeader) { -+ String key = pHeader.toLowerCase(); -+ Object o = headers.get(key); -+ List list; -+ if (o instanceof List) { -+ list = (List) o; -+ } else { -+ list = Collections.singletonList(o); -+ } -+ return list; -+ } -+ -+ public int getStatus() { -+ return status; -+ } -+ - public void addIntHeader(String pHeader, int pValue) { - addHeader(pHeader, Integer.toString(pValue)); - } -@@ -465,4 +487,6 @@ public class HttpServletResponseImpl implements HttpServletResponse { - sb.append("\r\n"); - return sb.toString(); - } -+ -+ public void setContentLengthLong(long arg0) { throw new IllegalStateException("Not implemented."); } - } -diff --git a/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java b/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java -index c2a53b1..86dbbb4 100644 ---- a/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java -+++ b/server/src/main/java/org/apache/xmlrpc/webserver/ServletOutputStreamImpl.java -@@ -22,6 +22,7 @@ import java.io.IOException; - import java.io.OutputStream; - - import javax.servlet.ServletOutputStream; -+import javax.servlet.WriteListener; - - - /** Default implementation of a servlet output stream. -@@ -99,4 +100,8 @@ class ServletOutputStreamImpl extends ServletOutputStream { - boolean isCommitted() { - return committed; - } -+ -+ public boolean isReady() { return true; } -+ -+ public void setWriteListener(WriteListener arg0) { throw new IllegalStateException("Not implemented."); } - } --- -2.26.0.rc2 - diff --git a/0002-Add-OSGi-metadata.patch b/0002-Add-OSGi-metadata.patch deleted file mode 100644 index b3e4c77..0000000 --- a/0002-Add-OSGi-metadata.patch +++ /dev/null @@ -1,74 +0,0 @@ -From 56ed627f9d69a9c065aab02e8f7d07524d4fa315 Mon Sep 17 00:00:00 2001 -From: Mat Booth -Date: Tue, 31 Mar 2020 17:00:03 +0100 -Subject: [PATCH 2/6] Add OSGi metadata - ---- - client/pom.xml | 11 +++++++++++ - common/pom.xml | 10 ++++++++++ - server/pom.xml | 6 ++++++ - 3 files changed, 27 insertions(+) - -diff --git a/client/pom.xml b/client/pom.xml -index e588657..f31b2d2 100644 ---- a/client/pom.xml -+++ b/client/pom.xml -@@ -48,6 +48,17 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 2 -+ %Bundle-Name -+ plugin -+ org.apache.xmlrpc -+ ${project.version} -+ org.apache.xmlrpc.common -+ org.apache.xmlrpc, org.apache.xmlrpc.client, org.apache.xmlrpc.client.util -+ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers -+ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 -+ dependent -+ %Bundle-Vendor.0 - - - -diff --git a/common/pom.xml b/common/pom.xml -index 5058d50..7a5bf49 100644 ---- a/common/pom.xml -+++ b/common/pom.xml -@@ -48,6 +48,16 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 2 -+ %Bundle-Name -+ plugin -+ org.apache.xmlrpc.common -+ ${project.version} -+ org.apache.xmlrpc, org.apache.xmlrpc.common, org.apache.xmlrpc.jaxb, org.apache.xmlrpc.parser, org.apache.xmlrpc.serializer, org.apache.xmlrpc.util -+ javax.xml.namespace, javax.xml.parsers, org.apache.commons.httpclient, org.apache.commons.httpclient.auth, org.apache.commons.httpclient.methods, org.apache.commons.httpclient.params, org.apache.commons.logging, org.apache.ws.commons.serialize, org.apache.ws.commons.util, org.w3c.dom, org.xml.sax, org.xml.sax.helpers -+ J2SE-1.4, CDC-1.0/Foundation-1.0, J2SE-1.3 -+ dependent -+ %Bundle-Vendor.0 - - - -diff --git a/server/pom.xml b/server/pom.xml -index 6cbc6e7..4c90e50 100644 ---- a/server/pom.xml -+++ b/server/pom.xml -@@ -48,6 +48,12 @@ - org.apache - Apache Software Foundation - ${project.version} -+ 1 -+ %Bundle-Name -+ org.apache.xmlrpc.server -+ ${project.version} -+ org.apache.xmlrpc.common -+ org.apache.xmlrpc.server,org.apache.xmlrpc.webserver - - - --- -2.26.0.rc2 - diff --git a/0003-disallow-deserialization-of-ex-serializable-tags.patch b/0003-disallow-deserialization-of-ex-serializable-tags.patch deleted file mode 100644 index 0b568c7..0000000 --- a/0003-disallow-deserialization-of-ex-serializable-tags.patch +++ /dev/null @@ -1,71 +0,0 @@ -From febe70f7ca78926660a7d11607a35f663165322a Mon Sep 17 00:00:00 2001 -From: Mat Booth -Date: Tue, 31 Mar 2020 17:01:29 +0100 -Subject: [PATCH 3/6] disallow deserialization of ex serializable tags - ---- - .../xmlrpc/parser/SerializableParser.java | 8 ++++++ - .../java/org/apache/xmlrpc/test/BaseTest.java | 28 ------------------- - 2 files changed, 8 insertions(+), 28 deletions(-) - -diff --git a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -index 18f25ac..c8bb7ed 100644 ---- a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -+++ b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java -@@ -29,6 +29,14 @@ import org.apache.xmlrpc.XmlRpcException; - */ - public class SerializableParser extends ByteArrayParser { - public Object getResult() throws XmlRpcException { -+ if (!"1".equals(System.getProperty("org.apache.xmlrpc.allowInsecureDeserialization"))) { -+ throw new UnsupportedOperationException( -+ "Deserialization of ex:serializable objects is vulnerable to " + -+ "remote execution attacks and is disabled by default. " + -+ "If you are sure the source data is trusted, you can enable " + -+ "it by setting org.apache.xmlrpc.allowInsecureDeserialization " + -+ "JVM property to 1"); -+ } - try { - byte[] res = (byte[]) super.getResult(); - ByteArrayInputStream bais = new ByteArrayInputStream(res); -diff --git a/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java b/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java -index 16699a6..6ad4b5e 100644 ---- a/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java -+++ b/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java -@@ -805,34 +805,6 @@ public class BaseTest extends XmlRpcTestCase { - assertTrue(ok); - } - -- /** Test, whether we can invoke a method, passing an instance of -- * {@link java.io.Serializable} as a parameter. -- * @throws Exception The test failed. -- */ -- public void testSerializableParam() throws Exception { -- for (int i = 0; i < providers.length; i++) { -- testSerializableParam(providers[i]); -- } -- } -- -- private void testSerializableParam(ClientProvider pProvider) throws Exception { -- final String methodName = "Remote.serializableParam"; -- Calendar cal = Calendar.getInstance(TimeZone.getTimeZone("GMT")); -- cal.set(2005, 5, 23, 8, 4, 0); -- cal.set(Calendar.MILLISECOND, 5); -- final Object[] params = new Object[]{new Remote.CalendarWrapper(cal)}; -- final XmlRpcClient client = pProvider.getClient(); -- Object result = client.execute(getExConfig(pProvider), methodName, params); -- assertEquals(new Long(cal.getTime().getTime()), result); -- boolean ok = false; -- try { -- client.execute(getConfig(pProvider), methodName, params); -- } catch (XmlRpcExtensionException e) { -- ok = true; -- } -- assertTrue(ok); -- } -- - /** Tests, whether we can invoke a method, passing an instance of - * {@link Calendar} as a parameter. - * @throws Exception The test failed. --- -2.26.0.rc2 - diff --git a/0004-disallow-loading-external-dtd.patch b/0004-disallow-loading-external-dtd.patch deleted file mode 100644 index f522b77..0000000 --- a/0004-disallow-loading-external-dtd.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 2c16d38ab18039327b2575f61c3035683f16cd7d Mon Sep 17 00:00:00 2001 -From: Mat Booth -Date: Tue, 31 Mar 2020 17:02:12 +0100 -Subject: [PATCH 4/6] disallow loading external dtd - ---- - .../src/main/java/org/apache/xmlrpc/util/SAXParsers.java | 7 +++++++ - 1 file changed, 7 insertions(+) - -diff --git a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java -index b1034e7..49ef5de 100644 ---- a/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java -+++ b/common/src/main/java/org/apache/xmlrpc/util/SAXParsers.java -@@ -48,6 +48,13 @@ public class SAXParsers { - } catch (org.xml.sax.SAXException e) { - // Ignore it - } -+ try { -+ spf.setFeature("http://apache.org/xml/features/nonvalidating/load-external-dtd", false); -+ } catch (javax.xml.parsers.ParserConfigurationException e) { -+ // Ignore it -+ } catch (org.xml.sax.SAXException e) { -+ // Ignore it -+ } - } - - /** Creates a new instance of {@link XMLReader}. --- -2.26.0.rc2 - diff --git a/0005-Remove-dep-on-ancient-commons-httpclient.patch b/0005-Remove-dep-on-ancient-commons-httpclient.patch deleted file mode 100644 index 1629c5a..0000000 --- a/0005-Remove-dep-on-ancient-commons-httpclient.patch +++ /dev/null @@ -1,466 +0,0 @@ -From 77f696a95873c6bd8cac9254579838db556044a6 Mon Sep 17 00:00:00 2001 -From: Mat Booth -Date: Tue, 31 Mar 2020 17:18:53 +0100 -Subject: [PATCH 5/6] Remove dep on ancient commons httpclient - ---- - client/pom.xml | 4 - - .../xmlrpc/client/XmlRpcCommonsTransport.java | 262 ------------------ - .../client/XmlRpcCommonsTransportFactory.java | 66 ----- - pom.xml | 6 - - server/pom.xml | 5 - - .../apache/xmlrpc/test/CommonsProvider.java | 41 --- - .../apache/xmlrpc/test/XmlRpcTestCase.java | 1 - - 7 files changed, 385 deletions(-) - delete mode 100644 client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java - delete mode 100644 client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java - delete mode 100644 server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java - -diff --git a/client/pom.xml b/client/pom.xml -index f31b2d2..b78ede0 100644 ---- a/client/pom.xml -+++ b/client/pom.xml -@@ -72,9 +72,5 @@ - xmlrpc-common - 3.1.3 - -- -- commons-httpclient -- commons-httpclient -- - - -diff --git a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java b/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java -deleted file mode 100644 -index 1e60ceb..0000000 ---- a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransport.java -+++ /dev/null -@@ -1,262 +0,0 @@ --/* -- * Licensed to the Apache Software Foundation (ASF) under one -- * or more contributor license agreements. See the NOTICE file -- * distributed with this work for additional information -- * regarding copyright ownership. The ASF licenses this file -- * to you under the Apache License, Version 2.0 (the -- * "License"); you may not use this file except in compliance -- * with the License. You may obtain a copy of the License at -- * -- * http://www.apache.org/licenses/LICENSE-2.0 -- * -- * Unless required by applicable law or agreed to in writing, -- * software distributed under the License is distributed on an -- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -- * KIND, either express or implied. See the License for the -- * specific language governing permissions and limitations -- * under the License. -- */ --package org.apache.xmlrpc.client; -- --import java.io.BufferedOutputStream; --import java.io.FilterOutputStream; --import java.io.IOException; --import java.io.InputStream; --import java.io.OutputStream; -- --import org.apache.commons.httpclient.Credentials; --import org.apache.commons.httpclient.Header; --import org.apache.commons.httpclient.HttpClient; --import org.apache.commons.httpclient.HttpException; --import org.apache.commons.httpclient.HttpMethod; --import org.apache.commons.httpclient.HttpStatus; --import org.apache.commons.httpclient.HttpVersion; --import org.apache.commons.httpclient.URI; --import org.apache.commons.httpclient.URIException; --import org.apache.commons.httpclient.UsernamePasswordCredentials; --import org.apache.commons.httpclient.auth.AuthScope; --import org.apache.commons.httpclient.methods.PostMethod; --import org.apache.commons.httpclient.methods.RequestEntity; --import org.apache.commons.httpclient.params.HttpMethodParams; --import org.apache.xmlrpc.XmlRpcException; --import org.apache.xmlrpc.XmlRpcRequest; --import org.apache.xmlrpc.common.XmlRpcStreamConfig; --import org.apache.xmlrpc.common.XmlRpcStreamRequestConfig; --import org.apache.xmlrpc.util.HttpUtil; --import org.apache.xmlrpc.util.XmlRpcIOException; --import org.xml.sax.SAXException; -- -- --/** An HTTP transport factory, which is based on the Jakarta Commons -- * HTTP Client. -- */ --public class XmlRpcCommonsTransport extends XmlRpcHttpTransport { -- /** -- * Maximum number of allowed redirects. -- */ -- private static final int MAX_REDIRECT_ATTEMPTS = 100; -- -- protected final HttpClient client; -- private static final String userAgent = USER_AGENT + " (Jakarta Commons httpclient Transport)"; -- protected PostMethod method; -- private int contentLength = -1; -- private XmlRpcHttpClientConfig config; -- -- /** Creates a new instance. -- * @param pFactory The factory, which created this transport. -- */ -- public XmlRpcCommonsTransport(XmlRpcCommonsTransportFactory pFactory) { -- super(pFactory.getClient(), userAgent); -- HttpClient httpClient = pFactory.getHttpClient(); -- if (httpClient == null) { -- httpClient = newHttpClient(); -- } -- client = httpClient; -- } -- -- protected void setContentLength(int pLength) { -- contentLength = pLength; -- } -- -- protected HttpClient newHttpClient() { -- return new HttpClient(); -- } -- -- protected void initHttpHeaders(XmlRpcRequest pRequest) throws XmlRpcClientException { -- config = (XmlRpcHttpClientConfig) pRequest.getConfig(); -- method = newPostMethod(config); -- super.initHttpHeaders(pRequest); -- -- if (config.getConnectionTimeout() != 0) -- client.getHttpConnectionManager().getParams().setConnectionTimeout(config.getConnectionTimeout()); -- -- if (config.getReplyTimeout() != 0) -- client.getHttpConnectionManager().getParams().setSoTimeout(config.getReplyTimeout()); -- -- method.getParams().setVersion(HttpVersion.HTTP_1_1); -- } -- -- protected PostMethod newPostMethod(XmlRpcHttpClientConfig pConfig) { -- return new PostMethod(pConfig.getServerURL().toString()); -- } -- -- protected void setRequestHeader(String pHeader, String pValue) { -- method.setRequestHeader(new Header(pHeader, pValue)); -- } -- -- protected boolean isResponseGzipCompressed() { -- Header h = method.getResponseHeader( "Content-Encoding" ); -- if (h == null) { -- return false; -- } else { -- return HttpUtil.isUsingGzipEncoding(h.getValue()); -- } -- } -- -- protected InputStream getInputStream() throws XmlRpcException { -- try { -- checkStatus(method); -- return method.getResponseBodyAsStream(); -- } catch (HttpException e) { -- throw new XmlRpcClientException("Error in HTTP transport: " + e.getMessage(), e); -- } catch (IOException e) { -- throw new XmlRpcClientException("I/O error in server communication: " + e.getMessage(), e); -- } -- } -- -- protected void setCredentials(XmlRpcHttpClientConfig pConfig) throws XmlRpcClientException { -- String userName = pConfig.getBasicUserName(); -- if (userName != null) { -- String enc = pConfig.getBasicEncoding(); -- if (enc == null) { -- enc = XmlRpcStreamConfig.UTF8_ENCODING; -- } -- client.getParams().setParameter(HttpMethodParams.CREDENTIAL_CHARSET, enc); -- Credentials creds = new UsernamePasswordCredentials(userName, pConfig.getBasicPassword()); -- AuthScope scope = new AuthScope(null, AuthScope.ANY_PORT, null, AuthScope.ANY_SCHEME); -- client.getState().setCredentials(scope, creds); -- client.getParams().setAuthenticationPreemptive(true); -- } -- } -- -- protected void close() throws XmlRpcClientException { -- method.releaseConnection(); -- } -- -- protected boolean isResponseGzipCompressed(XmlRpcStreamRequestConfig pConfig) { -- Header h = method.getResponseHeader( "Content-Encoding" ); -- if (h == null) { -- return false; -- } else { -- return HttpUtil.isUsingGzipEncoding(h.getValue()); -- } -- } -- -- protected boolean isRedirectRequired() { -- switch (method.getStatusCode()) { -- case HttpStatus.SC_MOVED_TEMPORARILY: -- case HttpStatus.SC_MOVED_PERMANENTLY: -- case HttpStatus.SC_SEE_OTHER: -- case HttpStatus.SC_TEMPORARY_REDIRECT: -- return true; -- default: -- return false; -- } -- } -- -- protected void resetClientForRedirect() -- throws XmlRpcException { -- //get the location header to find out where to redirect to -- Header locationHeader = method.getResponseHeader("location"); -- if (locationHeader == null) { -- throw new XmlRpcException("Invalid redirect: Missing location header"); -- } -- String location = locationHeader.getValue(); -- -- URI redirectUri = null; -- URI currentUri = null; -- try { -- currentUri = method.getURI(); -- String charset = currentUri.getProtocolCharset(); -- redirectUri = new URI(location, true, charset); -- method.setURI(redirectUri); -- } catch (URIException ex) { -- throw new XmlRpcException(ex.getMessage(), ex); -- } -- -- //And finally invalidate the actual authentication scheme -- method.getHostAuthState().invalidate(); -- } -- -- protected void writeRequest(final ReqWriter pWriter) throws XmlRpcException { -- method.setRequestEntity(new RequestEntity(){ -- public boolean isRepeatable() { return true; } -- public void writeRequest(OutputStream pOut) throws IOException { -- try { -- /* Make sure, that the socket is not closed by replacing it with our -- * own BufferedOutputStream. -- */ -- OutputStream ostream; -- if (isUsingByteArrayOutput(config)) { -- // No need to buffer the output. -- ostream = new FilterOutputStream(pOut){ -- public void close() throws IOException { -- flush(); -- } -- }; -- } else { -- ostream = new BufferedOutputStream(pOut){ -- public void close() throws IOException { -- flush(); -- } -- }; -- } -- pWriter.write(ostream); -- } catch (XmlRpcException e) { -- throw new XmlRpcIOException(e); -- } catch (SAXException e) { -- throw new XmlRpcIOException(e); -- } -- } -- public long getContentLength() { return contentLength; } -- public String getContentType() { return "text/xml"; } -- }); -- try { -- int redirectAttempts = 0; -- for (;;) { -- client.executeMethod(method); -- if (!isRedirectRequired()) { -- break; -- } -- if (redirectAttempts++ > MAX_REDIRECT_ATTEMPTS) { -- throw new XmlRpcException("Too many redirects."); -- } -- resetClientForRedirect(); -- } -- } catch (XmlRpcIOException e) { -- Throwable t = e.getLinkedException(); -- if (t instanceof XmlRpcException) { -- throw (XmlRpcException) t; -- } else { -- throw new XmlRpcException("Unexpected exception: " + t.getMessage(), t); -- } -- } catch (IOException e) { -- throw new XmlRpcException("I/O error while communicating with HTTP server: " + e.getMessage(), e); -- } -- } -- -- /** -- * Check the status of the HTTP request and throw an XmlRpcHttpTransportException if it -- * indicates that there is an error. -- * @param pMethod the method that has been executed -- * @throws XmlRpcHttpTransportException if the status of the method indicates that there is an error. -- */ -- private void checkStatus(HttpMethod pMethod) throws XmlRpcHttpTransportException { -- final int status = pMethod.getStatusCode(); -- -- // All status codes except SC_OK are handled as errors. Perhaps some should require special handling (e.g., SC_UNAUTHORIZED) -- if (status < 200 || status > 299) { -- throw new XmlRpcHttpTransportException(status, pMethod.getStatusText()); -- } -- } --} -diff --git a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java b/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java -deleted file mode 100644 -index 630d5b4..0000000 ---- a/client/src/main/java/org/apache/xmlrpc/client/XmlRpcCommonsTransportFactory.java -+++ /dev/null -@@ -1,66 +0,0 @@ --/* -- * Licensed to the Apache Software Foundation (ASF) under one -- * or more contributor license agreements. See the NOTICE file -- * distributed with this work for additional information -- * regarding copyright ownership. The ASF licenses this file -- * to you under the Apache License, Version 2.0 (the -- * "License"); you may not use this file except in compliance -- * with the License. You may obtain a copy of the License at -- * -- * http://www.apache.org/licenses/LICENSE-2.0 -- * -- * Unless required by applicable law or agreed to in writing, -- * software distributed under the License is distributed on an -- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -- * KIND, either express or implied. See the License for the -- * specific language governing permissions and limitations -- * under the License. -- */ --package org.apache.xmlrpc.client; -- --import org.apache.commons.httpclient.HttpClient; -- -- --/** An HTTP transport factory, which is based on the Jakarta Commons -- * HTTP Client. -- */ --public class XmlRpcCommonsTransportFactory extends XmlRpcTransportFactoryImpl { -- private HttpClient httpClient; -- -- /** Creates a new instance. -- * @param pClient The client, which is controlling the factory. -- */ -- public XmlRpcCommonsTransportFactory(XmlRpcClient pClient) { -- super(pClient); -- } -- -- public XmlRpcTransport getTransport() { -- return new XmlRpcCommonsTransport(this); -- } -- -- /** -- *

Sets the factories {@link HttpClient}. By default, a new instance -- * of {@link HttpClient} is created for any request.

-- *

Reusing the {@link HttpClient} is required, if you want to preserve -- * some state between requests. This applies, in particular, if you want -- * to use cookies: In that case, create an instance of {@link HttpClient}, -- * give it to the factory, and use {@link HttpClient#getState()} to -- * read or set cookies. -- */ -- public void setHttpClient(HttpClient pHttpClient) { -- httpClient = pHttpClient; -- } -- -- /** -- *

Returns the factories {@link HttpClient}. By default, a new instance -- * of {@link HttpClient} is created for any request.

-- *

Reusing the {@link HttpClient} is required, if you want to preserve -- * some state between requests. This applies, in particular, if you want -- * to use cookies: In that case, create an instance of {@link HttpClient}, -- * give it to the factory, and use {@link HttpClient#getState()} to -- * read or set cookies. -- */ -- public HttpClient getHttpClient() { -- return httpClient; -- } --} -diff --git a/pom.xml b/pom.xml -index 5e18625..55cc6a8 100644 ---- a/pom.xml -+++ b/pom.xml -@@ -321,12 +321,6 @@ - - - -- -- commons-httpclient -- commons-httpclient -- 3.0.1 -- provided -- - - commons-logging - commons-logging -diff --git a/server/pom.xml b/server/pom.xml -index 4c90e50..84234ff 100644 ---- a/server/pom.xml -+++ b/server/pom.xml -@@ -95,10 +95,5 @@ - javax.servlet - javax.servlet-api - -- -- commons-httpclient -- commons-httpclient -- test -- - - -diff --git a/server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java b/server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java -deleted file mode 100644 -index 2551a59..0000000 ---- a/server/src/test/java/org/apache/xmlrpc/test/CommonsProvider.java -+++ /dev/null -@@ -1,41 +0,0 @@ --/* -- * Licensed to the Apache Software Foundation (ASF) under one -- * or more contributor license agreements. See the NOTICE file -- * distributed with this work for additional information -- * regarding copyright ownership. The ASF licenses this file -- * to you under the Apache License, Version 2.0 (the -- * "License"); you may not use this file except in compliance -- * with the License. You may obtain a copy of the License at -- * -- * http://www.apache.org/licenses/LICENSE-2.0 -- * -- * Unless required by applicable law or agreed to in writing, -- * software distributed under the License is distributed on an -- * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY -- * KIND, either express or implied. See the License for the -- * specific language governing permissions and limitations -- * under the License. -- */ --package org.apache.xmlrpc.test; -- --import org.apache.xmlrpc.client.XmlRpcClient; --import org.apache.xmlrpc.client.XmlRpcCommonsTransportFactory; --import org.apache.xmlrpc.client.XmlRpcTransportFactory; --import org.apache.xmlrpc.server.XmlRpcHandlerMapping; -- -- --/** Provider for testing the -- * {@link org.apache.xmlrpc.client.XmlRpcCommonsTransport}. -- */ --public class CommonsProvider extends WebServerProvider { -- /** Creates a new instance. -- * @param pMapping The test servers handler mapping. -- */ -- public CommonsProvider(XmlRpcHandlerMapping pMapping) { -- super(pMapping, true); -- } -- -- protected XmlRpcTransportFactory getTransportFactory(XmlRpcClient pClient) { -- return new XmlRpcCommonsTransportFactory(pClient); -- } --} -diff --git a/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java b/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java -index a9d1fbf..de06406 100644 ---- a/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java -+++ b/server/src/test/java/org/apache/xmlrpc/test/XmlRpcTestCase.java -@@ -75,7 +75,6 @@ public abstract class XmlRpcTestCase extends TestCase { - // new LiteTransportProvider(mapping, false), Doesn't support HTTP/1.1 - new SunHttpTransportProvider(pMapping, true), - new SunHttpTransportProvider(pMapping, false), -- new CommonsProvider(pMapping), - new ServletWebServerProvider(pMapping, true), - new ServletWebServerProvider(pMapping, false) - }; --- -2.26.0.rc2 - diff --git a/0006-Fix-for-CVE-2019-17570.patch b/0006-Fix-for-CVE-2019-17570.patch deleted file mode 100644 index 8a93dc5..0000000 --- a/0006-Fix-for-CVE-2019-17570.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 1594395df534d60133d98884c9d9f5eb92d0652e Mon Sep 17 00:00:00 2001 -From: Mat Booth -Date: Wed, 1 Apr 2020 10:21:03 +0100 -Subject: [PATCH 6/6] Fix for CVE-2019-17570 - -Deserialization of server-side exception from faultCause in XMLRPC error response ---- - .../xmlrpc/parser/XmlRpcResponseParser.java | 28 ++++++++++--------- - 1 file changed, 15 insertions(+), 13 deletions(-) - -diff --git a/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java b/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java -index 087572b..f1b2427 100644 ---- a/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java -+++ b/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java -@@ -69,19 +69,21 @@ public class XmlRpcResponseParser extends RecursiveTypeParserImpl { - getDocumentLocator()); - } - errorMessage = (String) map.get("faultString"); -- Object exception = map.get("faultCause"); -- if (exception != null) { -- try { -- byte[] bytes = (byte[]) exception; -- ByteArrayInputStream bais = new ByteArrayInputStream(bytes); -- ObjectInputStream ois = new ObjectInputStream(bais); -- errorCause = (Throwable) ois.readObject(); -- ois.close(); -- bais.close(); -- } catch (Throwable t) { -- // Ignore me -- } -- } -+ if (((XmlRpcStreamRequestConfig)cfg).isEnabledForExceptions()) { -+ Object exception = map.get("faultCause"); -+ if (exception != null) { -+ try { -+ byte[] bytes = (byte[]) exception; -+ ByteArrayInputStream bais = new ByteArrayInputStream(bytes); -+ ObjectInputStream ois = new ObjectInputStream(bais); -+ errorCause = (Throwable) ois.readObject(); -+ ois.close(); -+ bais.close(); -+ } catch (Throwable t) { -+ // Ignore me -+ } -+ } -+ } - } - } - --- -2.26.0.rc2 - diff --git a/dead.package b/dead.package new file mode 100644 index 0000000..5204a84 --- /dev/null +++ b/dead.package @@ -0,0 +1 @@ +Orphaned for 6+ weeks diff --git a/sources b/sources deleted file mode 100644 index f4bbd2c..0000000 --- a/sources +++ /dev/null @@ -1 +0,0 @@ -f7817485fa6a6a500c49ec9515d1f3b9 apache-xmlrpc-3.1.3-src.tar.bz2 diff --git a/xmlrpc.spec b/xmlrpc.spec deleted file mode 100644 index 9a7a795..0000000 --- a/xmlrpc.spec +++ /dev/null @@ -1,197 +0,0 @@ -Name: xmlrpc -Version: 3.1.3 -Release: 28%{?dist} -Epoch: 1 -Summary: Java XML-RPC implementation -License: ASL 2.0 -URL: https://ws.apache.org/xmlrpc/ -BuildArch: noarch - -Source0: https://archive.apache.org/dist/ws/xmlrpc/sources/apache-xmlrpc-%{version}-src.tar.bz2 - -# Fix build against modern servlet API by implementing missing interfaces -Patch0: 0001-Javax-Servlet-API.patch -# Add OSGi metadata so that xmlrpc can be used in OSGi runtimes -Patch1: 0002-Add-OSGi-metadata.patch -# CVE-2016-5003 - Disallow deserialization of tags by default -Patch2: 0003-disallow-deserialization-of-ex-serializable-tags.patch -# CVE-2016-5002 - isallow loading of external DTD -Patch3: 0004-disallow-loading-external-dtd.patch -# Jakarta Commons HttpClient is obsolete and should not be used, one of the other -# provider implementations should by used instead by clients of xmlrpc -Patch4: 0005-Remove-dep-on-ancient-commons-httpclient.patch -# CVE-2019-17570 - Deserialization of server-side exception from faultCause in XMLRPC error response -Patch5: 0006-Fix-for-CVE-2019-17570.patch - -BuildRequires: maven-local -BuildRequires: mvn(commons-logging:commons-logging) -BuildRequires: mvn(javax.servlet:javax.servlet-api) -BuildRequires: mvn(javax.xml.bind:jaxb-api) -BuildRequires: mvn(junit:junit) -BuildRequires: mvn(org.apache:apache:pom:) -BuildRequires: mvn(org.apache.ws.commons.util:ws-commons-util) - -%description -Apache XML-RPC is a Java implementation of XML-RPC, a popular protocol -that uses XML over HTTP to implement remote procedure calls. - -%package javadoc -Summary: Javadoc for %{name} - -%description javadoc -Javadoc for %{name}. - -%package common -Summary: Common classes for XML-RPC client and server implementations - -%description common -%{summary}. - -%package client -Summary: XML-RPC client implementation - -%description client -%{summary}. - -%package server -Summary: XML-RPC server implementation - -%description server -%{summary}. - -%prep -%setup -q -n apache-%{name}-%{version}-src - -%patch0 -p1 -%patch1 -p1 -%patch2 -p1 -%patch3 -p1 -%patch4 -p1 -%patch5 -p1 - -sed -i 's/\r//' LICENSE.txt - -%pom_disable_module dist -%pom_remove_dep jaxme:jaxmeapi common -%pom_add_dep junit:junit:3.8.1:test - -%pom_remove_plugin :maven-javadoc-plugin - -# Add missing dep when building against Java 11 -%pom_add_dep javax.xml.bind:jaxb-api:2.2.12 - -# don't hard code source and target levels -sed -i -e '//d' \ - -e '//d' pom.xml - -%mvn_file :{*} @1 -%mvn_package :*-common %{name} - -%build -# ignore test failure because server part needs network -%mvn_build -s -- -Dmaven.test.failure.ignore=true \ - -Dmaven.compiler.source=1.8 -Dmaven.compiler.target=1.8 - -%install -%mvn_install - -%files common -f .mfiles-%{name} -%license LICENSE.txt NOTICE.txt - -%files client -f .mfiles-%{name}-client - -%files server -f .mfiles-%{name}-server - -%files javadoc -f .mfiles-javadoc -%license LICENSE.txt NOTICE.txt - -%changelog -* Thu Jan 28 2021 Fedora Release Engineering - 1:3.1.3-28 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Wed Jul 29 2020 Fedora Release Engineering - 1:3.1.3-27 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Sat Jul 11 2020 Jiri Vanek - 1:3.1.3-26 -- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11 - -* Fri Jun 19 2020 Mat Booth - 1:3.1.3-25 -- Allow building on Java 11 - -* Wed Apr 01 2020 Mat Booth - 1:3.1.3-24 -- Add patch for CVE-2019-17570 - -* Tue Mar 31 2020 Mat Booth - 1:3.1.3-23 -- Modernise spec file and remove dep on ancient Jakarta Commons httpclient implementation - -* Sun Feb 03 2019 Fedora Release Engineering - 1:3.1.3-22 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Sat Jul 14 2018 Fedora Release Engineering - 1:3.1.3-21 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Fri May 18 2018 Michael Simacek - 1:3.1.3-20 -- Disallow deserialization of tags by default -- Resolves CVE-2016-5003 -- Disallow loading of external DTD -- Resolves CVE-2016-5002 - -* Fri Feb 09 2018 Fedora Release Engineering - 1:3.1.3-19 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Thu Jul 27 2017 Fedora Release Engineering - 1:3.1.3-18 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Mon Jun 12 2017 Troy Dawson - 1:3.1.3-17 -- Add junit to pom deps. Was originally supplied by ws-commons-util (#1460767) - -* Sat Feb 11 2017 Fedora Release Engineering - 1:3.1.3-16 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Thu Jan 12 2017 Igor Gnatenko - 1:3.1.3-15 -- Rebuild for readline 7.x - -* Fri Feb 05 2016 Fedora Release Engineering - 1:3.1.3-14 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Fri Jun 19 2015 Fedora Release Engineering - 1:3.1.3-13 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Fri Feb 13 2015 gil cattaneo 1:3.1.3-12 -- introduce license macro - -* Thu Jul 10 2014 Sami Wagiaalla - 1:3.1.3-11 -- Add OSGi info for xmlrpc-server jar. -- export o.a.xmlrpc from xmlrpc-client jar. - -* Mon Jun 16 2014 Mikolaj Izdebski - 1:3.1.3-10 -- Use servlet 3.1.0 API - -* Sun Jun 08 2014 Fedora Release Engineering - 1:3.1.3-9 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Tue Mar 04 2014 Stanislav Ochotnicky - 1:3.1.3-8 -- Use Requires: java-headless rebuild (#1067528) - -* Sun Aug 04 2013 Fedora Release Engineering - 1:3.1.3-7 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Fri Jun 14 2013 Mikolaj Izdebski - 1:3.1.3-6 -- Update to current packaging guidelines - -* Fri May 17 2013 Alexander Kurtakov 1:3.1.3-5 -- Remove javax.xml.bind from osgi imports - it's part of the JVM now. -- Drop the ws-jaxme dependency for the same reason. - -* Fri Feb 15 2013 Fedora Release Engineering - 1:3.1.3-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild - -* Wed Feb 06 2013 Java SIG - 1:3.1.3-3 -- Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild -- Replace maven BuildRequires with maven-local - -* Sat Oct 20 2012 Peter Robinson 3.1.3-2 -- xmlrpc v2 had an Epoch so we need one here. Add it back - -* Fri Sep 14 2012 Alexander Kurtakov 3.1.3-1 -- First release of version 3.x package