From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id 8F5C31395E1 for ; Fri, 4 Nov 2016 08:43:32 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id 14A01E0BF5; Fri, 4 Nov 2016 08:43:29 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id D9B91E0BF5 for ; Fri, 4 Nov 2016 08:43:28 +0000 (UTC) Received: from oystercatcher.gentoo.org (unknown [IPv6:2a01:4f8:202:4333:225:90ff:fed9:fc84]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 7427334114E for ; Fri, 4 Nov 2016 08:43:26 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id DA10B24A2 for ; Fri, 4 Nov 2016 08:43:24 +0000 (UTC) From: "Johannes Huber" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Johannes Huber" Message-ID: <1478248982.9805f9685e3de42755d769ab31e73e30416cc1ef.johu@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: kde-frameworks/kcoreaddons/files/, kde-frameworks/kcoreaddons/ X-VCS-Repository: repo/gentoo X-VCS-Files: kde-frameworks/kcoreaddons/files/kcoreaddons-5.26.0-CVE-2016-7966.patch kde-frameworks/kcoreaddons/kcoreaddons-5.26.0-r1.ebuild X-VCS-Directories: kde-frameworks/kcoreaddons/ kde-frameworks/kcoreaddons/files/ X-VCS-Committer: johu X-VCS-Committer-Name: Johannes Huber X-VCS-Revision: 9805f9685e3de42755d769ab31e73e30416cc1ef X-VCS-Branch: master Date: Fri, 4 Nov 2016 08:43:24 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 4d9c8c04-367a-4aa8-9476-6859ce1661f9 X-Archives-Hash: bf384a98ff3078c684c1a9a3ef4a21bd commit: 9805f9685e3de42755d769ab31e73e30416cc1ef Author: Johannes Huber gentoo org> AuthorDate: Fri Nov 4 08:41:49 2016 +0000 Commit: Johannes Huber gentoo org> CommitDate: Fri Nov 4 08:43:02 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=9805f968 kde-frameworks/kcoreaddons: Remove vulnerable version Gentoo-bug: 596224 Package-Manager: portage-2.3.2 .../files/kcoreaddons-5.26.0-CVE-2016-7966.patch | 225 --------------------- .../kcoreaddons/kcoreaddons-5.26.0-r1.ebuild | 33 --- 2 files changed, 258 deletions(-) diff --git a/kde-frameworks/kcoreaddons/files/kcoreaddons-5.26.0-CVE-2016-7966.patch b/kde-frameworks/kcoreaddons/files/kcoreaddons-5.26.0-CVE-2016-7966.patch deleted file mode 100644 index 71dc769..00000000 --- a/kde-frameworks/kcoreaddons/files/kcoreaddons-5.26.0-CVE-2016-7966.patch +++ /dev/null @@ -1,225 +0,0 @@ -From 2a5142fecf8615ccfa3e7c1f9c088fa6ae5cc2a1 Mon Sep 17 00:00:00 2001 -From: Montel Laurent -Date: Wed, 21 Sep 2016 07:24:30 +0200 -Subject: [PATCH 1/2] Fix very old bug when we remove space in url as "foo - < >" - ---- - autotests/ktexttohtmltest.cpp | 14 ++++++++++++++ - src/lib/text/ktexttohtml.cpp | 14 ++++++++++++-- - 2 files changed, 26 insertions(+), 2 deletions(-) - -diff --git a/autotests/ktexttohtmltest.cpp b/autotests/ktexttohtmltest.cpp -index 474f0ca..8fc0c56 100644 ---- a/autotests/ktexttohtmltest.cpp -+++ b/autotests/ktexttohtmltest.cpp -@@ -30,6 +30,15 @@ QTEST_MAIN(KTextToHTMLTest) - - Q_DECLARE_METATYPE(KTextToHTML::Options) - -+#ifndef Q_OS_WIN -+void initLocale() -+{ -+ setenv("LC_ALL", "en_US.utf-8", 1); -+} -+Q_CONSTRUCTOR_FUNCTION(initLocale) -+#endif -+ -+ - void KTextToHTMLTest::testGetEmailAddress() - { - // empty input -@@ -372,6 +381,11 @@ void KTextToHTMLTest::testHtmlConvert_data() - QTest::newRow("url-in-parenthesis-3") << "bla (http://www.kde.org - section 5.2)" - << KTextToHTML::Options(KTextToHTML::PreserveSpaces) - << "bla (http://www.kde.org - section 5.2)"; -+ -+ // Fix url as foo < > when we concatened them. -+ QTest::newRow("url-with-url") << "foo >" -+ << KTextToHTML::Options(KTextToHTML::PreserveSpaces) -+ << "foo <http://www.kde.org/ <http://www.kde.org/>>"; - } - - -diff --git a/src/lib/text/ktexttohtml.cpp b/src/lib/text/ktexttohtml.cpp -index 8ed923d..b181f56 100644 ---- a/src/lib/text/ktexttohtml.cpp -+++ b/src/lib/text/ktexttohtml.cpp -@@ -228,11 +228,19 @@ QString KTextToHTMLHelper::getUrl() - - url.reserve(mMaxUrlLen); // avoid allocs - int start = mPos; -+ bool previousCharIsSpace = false; - while ((mPos < mText.length()) && - (mText[mPos].isPrint() || mText[mPos].isSpace()) && - ((afterUrl.isNull() && !mText[mPos].isSpace()) || - (!afterUrl.isNull() && mText[mPos] != afterUrl))) { -- if (!mText[mPos].isSpace()) { // skip whitespace -+ if (mText[mPos].isSpace()) { -+ previousCharIsSpace = true; -+ } else { // skip whitespace -+ if (previousCharIsSpace && mText[mPos] == QLatin1Char('<')) { -+ url.append(QLatin1Char(' ')); -+ break; -+ } -+ previousCharIsSpace = false; - url.append(mText[mPos]); - if (url.length() > mMaxUrlLen) { - break; -@@ -267,7 +275,6 @@ QString KTextToHTMLHelper::getUrl() - } - } while (url.length() > 1); - } -- - return url; - } - -@@ -334,6 +341,7 @@ QString KTextToHTML::convertToHtml(const QString &plainText, const KTextToHTML:: - QChar ch; - int x; - bool startOfLine = true; -+ //qDebug()<<" plainText"<parseEmoticons(result, true, exclude); - } -+ //qDebug()<<" result "< -Date: Fri, 30 Sep 2016 13:21:45 +0200 -Subject: [PATCH 2/2] Don't convert as url an url which has a " - ---- - autotests/ktexttohtmltest.cpp | 6 ++++++ - src/lib/text/ktexttohtml.cpp | 25 +++++++++++++++++++------ - src/lib/text/ktexttohtml_p.h | 2 +- - 3 files changed, 26 insertions(+), 7 deletions(-) - -diff --git a/autotests/ktexttohtmltest.cpp b/autotests/ktexttohtmltest.cpp -index 8fc0c56..c5690e8 100644 ---- a/autotests/ktexttohtmltest.cpp -+++ b/autotests/ktexttohtmltest.cpp -@@ -386,6 +386,12 @@ void KTextToHTMLTest::testHtmlConvert_data() - QTest::newRow("url-with-url") << "foo >" - << KTextToHTML::Options(KTextToHTML::PreserveSpaces) - << "foo <http://www.kde.org/ <http://www.kde.org/>>"; -+ -+ //Fix url exploit -+ QTest::newRow("url-exec-html") << "https://\">