From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id A8EC5139085 for ; Fri, 30 Dec 2016 16:42:02 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id F287D234B55; Fri, 30 Dec 2016 16:42:01 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id B99E4234B55 for ; Fri, 30 Dec 2016 16:42:01 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 315B0341701 for ; Fri, 30 Dec 2016 16:41:35 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 3AE6F2586 for ; Fri, 30 Dec 2016 16:41:13 +0000 (UTC) From: "Andreas Hüttel" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Andreas Hüttel" Message-ID: <1483116053.6ab4da0dccbc2a77285e0c200d2ee3df58249ec6.dilfridge@gentoo> Subject: [gentoo-commits] repo/gentoo:master commit in: dev-perl/XML-LibXML/files/, dev-perl/XML-LibXML/ X-VCS-Repository: repo/gentoo X-VCS-Files: dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch X-VCS-Directories: dev-perl/XML-LibXML/ dev-perl/XML-LibXML/files/ X-VCS-Committer: dilfridge X-VCS-Committer-Name: Andreas Hüttel X-VCS-Revision: 6ab4da0dccbc2a77285e0c200d2ee3df58249ec6 X-VCS-Branch: master Date: Fri, 30 Dec 2016 16:41:13 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 6e40c489-20a0-4dd0-acf9-c9f5d5f16e26 X-Archives-Hash: 318a39ea4882d1eec9b803096c81d9c1 commit: 6ab4da0dccbc2a77285e0c200d2ee3df58249ec6 Author: Andreas K. Hüttel gentoo org> AuthorDate: Fri Dec 30 16:40:18 2016 +0000 Commit: Andreas Hüttel gentoo org> CommitDate: Fri Dec 30 16:40:53 2016 +0000 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=6ab4da0d dev-perl/XML-LibXML: Disable expanding external entities by default, bug 594614 Patch by ppisar redhat.com https://rt.cpan.org/Public/Bug/Display.html?id=118032 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=838097 https://bugzilla.redhat.com/show_bug.cgi?id=1377996 Package-Manager: Portage-2.3.3, Repoman-2.3.1 dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild | 70 +++++++++++++++++++++ .../XML-LibXML-2.12.800-disable-expanding.patch | 72 ++++++++++++++++++++++ 2 files changed, 142 insertions(+) diff --git a/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild b/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild new file mode 100644 index 00000000..75c4674 --- /dev/null +++ b/dev-perl/XML-LibXML/XML-LibXML-2.12.800-r1.ebuild @@ -0,0 +1,70 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 + +DIST_AUTHOR=SHLOMIF +DIST_VERSION=2.0128 +DIST_EXAMPLES=("example/*") +inherit perl-module + +DESCRIPTION="Perl binding for libxml2" + +SLOT="0" +KEYWORDS="~alpha ~amd64 ~arm ~hppa ~ia64 ~mips ~ppc ~ppc64 ~sparc ~x86 ~amd64-fbsd ~x86-fbsd ~x86-interix ~amd64-linux ~arm-linux ~x86-linux ~ppc-macos ~x64-macos ~x86-macos ~sparc-solaris ~x64-solaris ~x86-solaris" +IUSE="test minimal" + +RDEPEND=" + >=dev-perl/XML-SAX-0.120.0 + >=dev-libs/libxml2-2.6.21 + dev-perl/XML-SAX-Base + >=dev-perl/XML-NamespaceSupport-1.70.0 +" +DEPEND="${RDEPEND} + virtual/perl-ExtUtils-MakeMaker + test? ( + !minimal? ( + dev-perl/Test-LeakTrace + ) + ) +" + +PATCHES=( + "${FILESDIR}/${P}-disable-expanding.patch" +) + +src_compile() { + export SKIP_SAX_INSTALL=1 + perl-module_src_compile +} + +src_test() { + perl_rm_files t/pod.t t/style-trailing-space.t t/cpan-changes.t + perl-module_src_test +} + +pkg_postinst() { + pkg_update_parser add XML::LibXML::SAX::Parser + pkg_update_parser add XML::LibXML::SAX +} + +pkg_postrm() { + pkg_update_parser remove XML::LibXML::SAX::Parser + pkg_update_parser remove XML::LibXML::SAX +} + +pkg_update_parser() { + # pkg_update_parser [add|remove] $parser_module + local action=$1 + local parser_module=$2 + + if [[ "$ROOT" = "/" ]] ; then + einfo "Update Parser: $1 $2" + perl -MXML::SAX -e "XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()" \ + || ewarn "Update Parser: $1 $2 failed" + else + elog "To $1 $2 run:" + elog "perl -MXML::SAX -e 'XML::SAX->${action}_parser(q(${parser_module}))->save_parsers()'" + fi +} diff --git a/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch new file mode 100644 index 00000000..8be7783 --- /dev/null +++ b/dev-perl/XML-LibXML/files/XML-LibXML-2.12.800-disable-expanding.patch @@ -0,0 +1,72 @@ +From 05749ae525317d05bd9d4232c080e530854f1d88 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= +Date: Fri, 30 Sep 2016 14:31:26 +0200 +Subject: [PATCH] Do not enable expanding entities by default +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Expanding external entity is insecure. +. +This patch makes expand_entities option disabled by default. + +CPAN RT#118032 + +Signed-off-by: Petr Písař +--- + LibXML.pm | 2 +- + docs/libxml.dbk | 2 +- + t/43options.t | 4 ++-- + 3 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/LibXML.pm b/LibXML.pm +index eb3cbd6..9ab4748 100644 +--- a/LibXML.pm ++++ b/LibXML.pm +@@ -261,7 +261,7 @@ use constant { + HTML_PARSE_NOERROR => (1<<5), # suppress error reports + }; + +-$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD | XML_PARSE_NOENT ); ++$XML_LIBXML_PARSE_DEFAULTS = ( XML_PARSE_NODICT | XML_PARSE_DTDLOAD ); + + # this hash is made global so that applications can add names for new + # libxml2 parser flags as temporary workaround +diff --git a/docs/libxml.dbk b/docs/libxml.dbk +index 30f279b..2c6674b 100644 +--- a/docs/libxml.dbk ++++ b/docs/libxml.dbk +@@ -1676,7 +1676,7 @@ local $XML::LibXML::setTagCompression = 1; + expand_entities + + /parser, reader/ +- substitute entities; possible values are 0 and 1; default is 1 ++ substitute entities; possible values are 0 and 1; default is 0 + Note that although this flag disables entity substitution, it + does not prevent the parser from loading external entities; + when substitution of an external entity is disabled, the +diff --git a/t/43options.t b/t/43options.t +index 826f0ad..53dd35e 100644 +--- a/t/43options.t ++++ b/t/43options.t +@@ -50,7 +50,7 @@ no_network + { + my $p = XML::LibXML->new(); + for my $opt (@all) { +- my $ret = (($opt =~ /^(?:load_ext_dtd|expand_entities)$/) ? 1 : 0); ++ my $ret = (($opt =~ /^(?:load_ext_dtd)$/) ? 1 : 0); + # TEST*$all + ok( + ($p->get_option($opt)||0) == $ret +@@ -110,7 +110,7 @@ no_network + ok( $p->get_option('recover') == 2, ' TODO : Add test name' ); + + # TEST +- ok( $p->expand_entities() == 1, ' TODO : Add test name' ); ++ ok( $p->expand_entities() == 0, ' TODO : Add test name' ); + # TEST + ok( $p->load_ext_dtd() == 1, ' TODO : Add test name' ); + $p->load_ext_dtd(0); +-- +2.7.4 +