CVE-2024-21742.patch

@@ -1,159 +0,0 @@
-From 9dec5df2a588fed8027839815daefa79ee66efd1 Mon Sep 17 00:00:00 2001
-From: Benoit TELLIER <btellier@linagora.com>
-Date: Fri, 5 Jan 2024 08:12:54 +0100
-Subject: [PATCH] [FIX] Prevent header injection with MIME4J DOM (#91)
-
----
- core/pom.xml                                  |  5 +++
- .../apache/james/mime4j/stream/RawField.java  | 23 +++++++++++
- .../james/mime4j/stream/RawFieldTest.java     | 40 +++++++++++++++++--
- .../message/DefaultMessageWriterTest.java     | 11 +++++
- 4 files changed, 76 insertions(+), 3 deletions(-)
-
-diff --git a/core/pom.xml b/core/pom.xml
-index 942e3e3..412ad67 100644
---- a/core/pom.xml
-+++ b/core/pom.xml
-@@ -42,6 +42,11 @@
-             <artifactId>commons-io</artifactId>
-             <scope>test</scope>
-         </dependency>
-+	<dependency>
-+	    <groupId>org.assertj</groupId>
-+	    <artifactId>assertj-core</artifactId>
-+	    <scope>test</scope>
-+	</dependency>
-     </dependencies>
- 
-     <build>
-diff --git a/core/src/main/java/org/apache/james/mime4j/stream/RawField.java b/core/src/main/java/org/apache/james/mime4j/stream/RawField.java
-index 8bcaa77..03a00dd 100644
---- a/core/src/main/java/org/apache/james/mime4j/stream/RawField.java
-+++ b/core/src/main/java/org/apache/james/mime4j/stream/RawField.java
-@@ -55,6 +55,29 @@ public final class RawField implements Field {
- 
-     public RawField(String name, String body) {
-         this(null, -1, name, body);
-+
-+        int pos = 0;
-+
-+        while (true) {
-+            pos = body.indexOf('\r', pos);
-+            if (pos < 0) {
-+                break;
-+            }
-+            if (pos < body.length() + 2) {
-+                if (body.charAt(pos + 1) != '\n') {
-+                    throw new IllegalArgumentException("Injection of un-encoded line breaks inside header field could be assimilated to header injection");
-+                }
-+                if (pos != body.length() - 2 && !isSpace(body, pos + 2)) {
-+                    throw new IllegalArgumentException("Injection of un-encoded line breaks inside header field could be assimilated to header injection");
-+                }
-+            }
-+            pos ++;
-+        }
-+    }
-+
-+    private static boolean isSpace(String body, int pos) {
-+        return body.charAt(pos) == ' '
-+            || body.charAt(pos) == '\t';
-     }
- 
-     public ByteSequence getRaw() {
-diff --git a/core/src/test/java/org/apache/james/mime4j/stream/RawFieldTest.java b/core/src/test/java/org/apache/james/mime4j/stream/RawFieldTest.java
-index 5a1cc7d..90d8513 100644
---- a/core/src/test/java/org/apache/james/mime4j/stream/RawFieldTest.java
-+++ b/core/src/test/java/org/apache/james/mime4j/stream/RawFieldTest.java
-@@ -19,6 +19,9 @@
- 
- package org.apache.james.mime4j.stream;
- 
-+import static org.assertj.core.api.AssertionsForClassTypes.assertThatCode;
-+import static org.assertj.core.api.AssertionsForClassTypes.assertThatThrownBy;
-+
- import junit.framework.Assert;
- import org.apache.james.mime4j.util.ByteSequence;
- import org.apache.james.mime4j.util.ContentUtil;
-@@ -45,11 +48,11 @@ public class RawFieldTest {
-         Assert.assertEquals("stuff", field1.getBody());
-         Assert.assertEquals("raw: stuff", field1.toString());
- 
--        RawField field2 = new RawField("raw", null);
-+        RawField field2 = new RawField("raw", "any");
-         Assert.assertNull(field2.getRaw());
-         Assert.assertEquals("raw", field2.getName());
--        Assert.assertEquals(null, field2.getBody());
--        Assert.assertEquals("raw: ", field2.toString());
-+        Assert.assertEquals("any", field2.getBody());
-+        Assert.assertEquals("raw: any", field2.toString());
-     }
- 
-     @Test
-@@ -63,4 +66,35 @@ public class RawFieldTest {
-         Assert.assertEquals(s, field.toString());
-     }
- 
-+    @Test
-+    public void shouldRejectAmbiguousLineEnding() {
-+        assertThatThrownBy(() -> new RawField("Name", "Value\r\ncheating")).isInstanceOf(IllegalArgumentException.class);
-+    }
-+
-+    @Test
-+    public void shouldAcceptCRLFTerminatedHeader() {
-+        assertThatCode(() -> new RawField("Name", "Value\r\n")).doesNotThrowAnyException();
-+    }
-+
-+    @Test
-+    public void shouldAcceptTabFolding() {
-+        assertThatCode(() -> new RawField("Name", "Value\r\n\thello")).doesNotThrowAnyException();
-+    }
-+
-+    @Test
-+    public void shouldAcceptSpaceFolding() {
-+        assertThatCode(() -> new RawField("Name", "Value\r\n hello")).doesNotThrowAnyException();
-+    }
-+
-+    @Test
-+    public void shouldAcceptOnlyDelimiter() {
-+        assertThatCode(() -> new RawField("Name", "\r\n")).doesNotThrowAnyException();
-+    }
-+
-+
-+    @Test
-+    public void shouldAcceptNoDelimiter() {
-+        assertThatCode(() -> new RawField("Name", "Value")).doesNotThrowAnyException();
-+    }
-+
- }
-diff --git a/dom/src/test/java/org/apache/james/mime4j/message/DefaultMessageWriterTest.java b/dom/src/test/java/org/apache/james/mime4j/message/DefaultMessageWriterTest.java
-index dece2b5..19eafe2 100644
---- a/dom/src/test/java/org/apache/james/mime4j/message/DefaultMessageWriterTest.java
-+++ b/dom/src/test/java/org/apache/james/mime4j/message/DefaultMessageWriterTest.java
-@@ -20,6 +20,7 @@
- package org.apache.james.mime4j.message;
- 
- import static org.assertj.core.api.Assertions.assertThat;
-+import static org.assertj.core.api.Assertions.assertThatThrownBy;
- 
- import org.apache.james.mime4j.Charsets;
- import org.apache.james.mime4j.dom.Message;
-@@ -46,5 +47,15 @@ public class DefaultMessageWriterTest {
-                 "\r\n" +
-                 "this is the body");
-     }
-+    
-+    @Test
-+    public void shouldThrowOnHeaderInjectionAttempt() throws Exception {
-+        Message.Builder builder = Message.Builder.of()
-+            .setBody("this is the body", Charsets.UTF_8)
-+            .setFrom("sender@localhost");
-+
-+        assertThatThrownBy(() -> builder.setContentTransferEncoding("victim@attacker.com\r\nReply-To: attacker@evil.com"))
-+            .isInstanceOf(IllegalArgumentException.class);
-+    }
- 
- }
-\ No newline at end of file
--- 
-2.33.0
-

apache-mime4j.spec

@@ -1,21 +1,15 @@
 Name:                apache-mime4j
-Version:             0.8.7
+Version:             0.8.1
-Release:             4
+Release:             2
 Summary:             Apache JAMES Mime4j
-License:             Apache-2.0
+License:             ASL 2.0 and Artistic
 URL:                 http://james.apache.org/mime4j
-Source0:             http://archive.apache.org/dist/james/mime4j/${version}/james-mime4j-sources-%{version}.zip
+Source0:             http://archive.apache.org/dist/james/mime4j/0.8.1/james-mime4j-sources-0.8.1.zip
-# https://github.com/apache/james-mime4j/commit/9dec5df2a588fed8027839815daefa79ee66efd1
-Patch0:              CVE-2024-21742.patch
 BuildRequires:       maven-local mvn(com.google.guava:guava:18.0) mvn(commons-io:commons-io)
 BuildRequires:       mvn(commons-logging:commons-logging) mvn(junit:junit)
 BuildRequires:       mvn(org.apache:apache:pom:) mvn(org.apache.felix:maven-bundle-plugin)
 BuildRequires:       mvn(org.assertj:assertj-core) mvn(org.codehaus.mojo:javacc-maven-plugin)
 BuildRequires:       mvn(org.mockito:mockito-core) mvn(org.slf4j:slf4j-api)
-BuildRequires:       mvn(com.google.guava:guava)
-BuildRequires:       java-11-openjdk-devel
-Requires:            java-11-openjdk
-Requires:            javapackages-tools
 BuildArch:           noarch
 %description
 Java stream based MIME message parser.
@@ -26,7 +20,7 @@ Summary:             Javadoc for %{name}
 API documentation for %{name}.
 
 %prep
-%autosetup -n %{name}-project-%{version} -p1
+%setup -q -n james-mime4j
 %pom_remove_plugin :apache-rat-plugin
 %pom_remove_plugin :maven-jar-plugin
 %pom_disable_module assemble
@@ -35,37 +29,19 @@ for p in core dom storage; do
 done
 
 %build
-export JAVA_HOME=%{_jvmdir}/java-11-openjdk
-export CFLAGS="${RPM_OPT_FLAGS}"
-export CXXFLAGS="${RPM_OPT_FLAGS}"
 %mvn_build
 
 %install
 %mvn_install
 
 %files -f .mfiles
-%doc CHANGELOG.md
+%doc RELEASE_NOTES.txt
 %license LICENSE NOTICE
 
 %files javadoc -f .mfiles-javadoc
 %license LICENSE NOTICE
 
 %changelog
-* Thu Apr 11 2024 Dingli Zhang <dingli@iscas.ac.cn> - 0.8.7-4
-- Update to OpenJDK-11 and fix LenientDateTimeFieldTest
-
-* Thu Feb 29 2024 yaoxin <yao_xin001@hoperun.com> - 0.8.7-3
-- Fix CVE-2024-21742
-
-* Fri Feb 23 2024 zke_012020 <keer.oerv@isrc.iscas.ac.cn> - 0.8.7-2
-- Update spec for riscv64
-
-* Wed Dec 13 2023 Ge Wang <wang__ge@126.com> - 0.8.7-1
-- Upgrade to version 0.8.7
-
-* Tue Jun 14 2022 SimpleUpdate Robot <tc@openeuler.org> - 0.8.3-1
-- Upgrade to version 0.8.3
-
 * Tue Dec 22 2020 Ge Wang <wangge20@huawei.com> - 0.8.1-2
 - Modify license infomation