diff --git a/CVE-2023-2976-pre.patch b/CVE-2023-2976-pre.patch index 28f161f..6d5288f 100644 --- a/CVE-2023-2976-pre.patch +++ b/CVE-2023-2976-pre.patch @@ -10,17 +10,92 @@ RELNOTES=n/a PiperOrigin-RevId: 526998248 Origin: https://github.com/google/guava/commit/364aed58e083e305f3f9ffc5bcacf9536f2472ab - --- - .../common/io/FilesCreateTempDirTest.java | 37 +++++++++++++++++ - .../test/com/google/common/io/FilesTest.java | 15 +++---- - .../common/annotations/J2ktIncompatible.java | 31 ++++++++++++++ - .../io/ElementTypesAreNonnullByDefault.java | 41 +++++++++++++++++++ - 4 files changed, 115 insertions(+), 9 deletions(-) + .../common/io/FilesCreateTempDirTest.java | 38 +++++++++++++++++++ + .../test/com/google/common/io/FilesTest.java | 15 +++----- + .../common/io/FilesCreateTempDirTest.java | 37 ++++++++++++++++++ + .../test/com/google/common/io/FilesTest.java | 15 +++----- + 4 files changed, 87 insertions(+), 18 deletions(-) + create mode 100644 android/guava-tests/test/com/google/common/io/FilesCreateTempDirTest.java create mode 100644 guava-tests/test/com/google/common/io/FilesCreateTempDirTest.java - create mode 100644 guava/src/com/google/common/annotations/J2ktIncompatible.java - create mode 100644 guava/src/com/google/common/io/ElementTypesAreNonnullByDefault.java +diff --git a/android/guava-tests/test/com/google/common/io/FilesCreateTempDirTest.java b/android/guava-tests/test/com/google/common/io/FilesCreateTempDirTest.java +new file mode 100644 +index 0000000..109342a +--- /dev/null ++++ b/android/guava-tests/test/com/google/common/io/FilesCreateTempDirTest.java +@@ -0,0 +1,38 @@ ++/* ++ * Copyright (C) 2007 The Guava Authors ++ * ++ * Licensed under the Apache License, Version 2.0 (the "License"); ++ * you may not use this file except in compliance with the License. ++ * You may obtain a copy of the License at ++ * ++ * http://www.apache.org/licenses/LICENSE-2.0 ++ * ++ * Unless required by applicable law or agreed to in writing, software ++ * distributed under the License is distributed on an "AS IS" BASIS, ++ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. ++ * See the License for the specific language governing permissions and ++ * limitations under the License. ++ */ ++ ++package com.google.common.io; ++ ++import static com.google.common.truth.Truth.assertThat; ++ ++import java.io.File; ++import junit.framework.TestCase; ++ ++/** ++ * Unit test for {@link Files#createTempDir}. ++ * ++ * @author Chris Nokleberg ++ */ ++ ++public class FilesCreateTempDirTest extends TestCase { ++ public void testCreateTempDir() { ++ File temp = Files.createTempDir(); ++ assertTrue(temp.exists()); ++ assertTrue(temp.isDirectory()); ++ assertThat(temp.listFiles()).isEmpty(); ++ assertTrue(temp.delete()); ++ } ++} +diff --git a/android/guava-tests/test/com/google/common/io/FilesTest.java b/android/guava-tests/test/com/google/common/io/FilesTest.java +index 8446da1..338059e 100644 +--- a/android/guava-tests/test/com/google/common/io/FilesTest.java ++++ b/android/guava-tests/test/com/google/common/io/FilesTest.java +@@ -42,7 +42,12 @@ import junit.framework.TestSuite; + /** + * Unit test for {@link Files}. + * +- *

Note: {@link Files#fileTraverser()} is tested in {@link FilesFileTraverserTest}. ++ *

Some methods are tested in separate files: ++ * ++ *

+ * + * @author Chris Nokleberg + */ +@@ -357,14 +362,6 @@ public class FilesTest extends IoTestCase { + } + } + +- public void testCreateTempDir() { +- File temp = Files.createTempDir(); +- assertTrue(temp.exists()); +- assertTrue(temp.isDirectory()); +- assertThat(temp.listFiles()).isEmpty(); +- assertTrue(temp.delete()); +- } +- + public void testMove() throws IOException { + File i18nFile = getTestFile("i18n.txt"); + File temp1 = createTempFile(); diff --git a/guava-tests/test/com/google/common/io/FilesCreateTempDirTest.java b/guava-tests/test/com/google/common/io/FilesCreateTempDirTest.java new file mode 100644 index 0000000..557689e @@ -65,10 +140,10 @@ index 0000000..557689e + } +} diff --git a/guava-tests/test/com/google/common/io/FilesTest.java b/guava-tests/test/com/google/common/io/FilesTest.java -index e987f60..d552e0f 100644 +index 8446da1..338059e 100644 --- a/guava-tests/test/com/google/common/io/FilesTest.java +++ b/guava-tests/test/com/google/common/io/FilesTest.java -@@ -43,7 +43,12 @@ import junit.framework.TestSuite; +@@ -42,7 +42,12 @@ import junit.framework.TestSuite; /** * Unit test for {@link Files}. * @@ -82,7 +157,7 @@ index e987f60..d552e0f 100644 * * @author Chris Nokleberg */ -@@ -358,14 +363,6 @@ public class FilesTest extends IoTestCase { +@@ -357,14 +362,6 @@ public class FilesTest extends IoTestCase { } } @@ -97,90 +172,6 @@ index e987f60..d552e0f 100644 public void testMove() throws IOException { File i18nFile = getTestFile("i18n.txt"); File temp1 = createTempFile(); -diff --git a/guava/src/com/google/common/annotations/J2ktIncompatible.java b/guava/src/com/google/common/annotations/J2ktIncompatible.java -new file mode 100644 -index 0000000..6e28d02 ---- /dev/null -+++ b/guava/src/com/google/common/annotations/J2ktIncompatible.java -@@ -0,0 +1,31 @@ -+/* -+ * Copyright (C) 2009 The Guava Authors -+ * -+ * Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except -+ * in compliance with the License. You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software distributed under the License -+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express -+ * or implied. See the License for the specific language governing permissions and limitations under -+ * the License. -+ */ -+ -+package com.google.common.annotations; -+ -+import java.lang.annotation.ElementType; -+import java.lang.annotation.Retention; -+import java.lang.annotation.RetentionPolicy; -+import java.lang.annotation.Target; -+ -+/** -+ * The presence of this annotation on an API indicates that the method may not be used with -+ * J2kt. -+ * -+ * @since NEXT -+ */ -+@Retention(RetentionPolicy.CLASS) -+@Target({ElementType.TYPE, ElementType.METHOD, ElementType.CONSTRUCTOR, ElementType.FIELD}) -+@GwtCompatible -+public @interface J2ktIncompatible {} -diff --git a/guava/src/com/google/common/io/ElementTypesAreNonnullByDefault.java b/guava/src/com/google/common/io/ElementTypesAreNonnullByDefault.java -new file mode 100644 -index 0000000..48bc10f ---- /dev/null -+++ b/guava/src/com/google/common/io/ElementTypesAreNonnullByDefault.java -@@ -0,0 +1,41 @@ -+/* -+ * Copyright (C) 2021 The Guava Authors -+ * -+ * Licensed under the Apache License, Version 2.0 (the "License"); -+ * you may not use this file except in compliance with the License. -+ * You may obtain a copy of the License at -+ * -+ * http://www.apache.org/licenses/LICENSE-2.0 -+ * -+ * Unless required by applicable law or agreed to in writing, software -+ * distributed under the License is distributed on an "AS IS" BASIS, -+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -+ * See the License for the specific language governing permissions and -+ * limitations under the License. -+ */ -+ -+package com.google.common.io; -+ -+import static java.lang.annotation.ElementType.FIELD; -+import static java.lang.annotation.ElementType.METHOD; -+import static java.lang.annotation.ElementType.PARAMETER; -+import static java.lang.annotation.ElementType.TYPE; -+import static java.lang.annotation.RetentionPolicy.RUNTIME; -+ -+import com.google.common.annotations.GwtCompatible; -+import java.lang.annotation.Retention; -+import java.lang.annotation.Target; -+import javax.annotation.Nonnull; -+import javax.annotation.meta.TypeQualifierDefault; -+ -+/** -+ * Marks all "top-level" types as non-null in a way that is recognized by Kotlin. Note that this -+ * unfortunately includes type-variable usages, so we also provide {@link ParametricNullness} to -+ * "undo" it as best we can. -+ */ -+@GwtCompatible -+@Retention(RUNTIME) -+@Target(TYPE) -+@TypeQualifierDefault({FIELD, METHOD, PARAMETER}) -+@Nonnull -+@interface ElementTypesAreNonnullByDefault {} -- -2.33.0 +2.41.0 diff --git a/CVE-2023-2976.patch b/CVE-2023-2976.patch index 654728c..694d9a5 100644 --- a/CVE-2023-2976.patch +++ b/CVE-2023-2976.patch @@ -13,26 +13,25 @@ RELNOTES=Reimplemented `Files.createTempDir` and `FileBackedOutputStream` to fur PiperOrigin-RevId: 535359233 Refer: https://github.com/google/guava/commit/feb83a1c8fd2e7670b244d5afd23cba5aca43284 - --- .../common/io/FileBackedOutputStreamTest.java | 27 +++ .../common/io/FilesCreateTempDirTest.java | 41 +++- - .../common/io/FileBackedOutputStream.java | 16 +- - guava/src/com/google/common/io/Files.java | 48 ++--- + .../common/io/FileBackedOutputStream.java | 22 ++- + guava/src/com/google/common/io/Files.java | 51 ++--- .../common/io/IgnoreJRERequirement.java | 30 +++ .../com/google/common/io/TempFileCreator.java | 176 ++++++++++++++++++ - 6 files changed, 302 insertions(+), 36 deletions(-) + 6 files changed, 302 insertions(+), 45 deletions(-) create mode 100644 guava/src/com/google/common/io/IgnoreJRERequirement.java create mode 100644 guava/src/com/google/common/io/TempFileCreator.java diff --git a/guava-tests/test/com/google/common/io/FileBackedOutputStreamTest.java b/guava-tests/test/com/google/common/io/FileBackedOutputStreamTest.java -index 66558e9..db74f32 100644 +index 6841a41..2dae0ed 100644 --- a/guava-tests/test/com/google/common/io/FileBackedOutputStreamTest.java +++ b/guava-tests/test/com/google/common/io/FileBackedOutputStreamTest.java -@@ -16,10 +16,18 @@ - +@@ -17,10 +17,18 @@ package com.google.common.io; + +import static com.google.common.base.StandardSystemProperty.JAVA_IO_TMPDIR; +import static com.google.common.truth.Truth.assertThat; +import static java.nio.file.attribute.PosixFilePermission.OWNER_READ; @@ -48,7 +47,7 @@ index 66558e9..db74f32 100644 import java.util.Arrays; /** -@@ -59,10 +67,21 @@ public class FileBackedOutputStreamTest extends IoTestCase { +@@ -61,10 +69,21 @@ public class FileBackedOutputStreamTest extends IoTestCase { // Write data to go over the threshold if (chunk2 > 0) { @@ -70,7 +69,7 @@ index 66558e9..db74f32 100644 } out.close(); -@@ -129,6 +148,10 @@ public class FileBackedOutputStreamTest extends IoTestCase { +@@ -133,6 +152,10 @@ public class FileBackedOutputStreamTest extends IoTestCase { FileBackedOutputStream out = new FileBackedOutputStream(50); ByteSource source = out.asByteSource(); @@ -81,7 +80,7 @@ index 66558e9..db74f32 100644 out.write(data); assertTrue(Arrays.equals(data, source.read())); -@@ -160,4 +183,8 @@ public class FileBackedOutputStreamTest extends IoTestCase { +@@ -164,4 +187,8 @@ public class FileBackedOutputStreamTest extends IoTestCase { out.close(); } @@ -153,19 +152,18 @@ index 557689e..62098ef 100644 } } diff --git a/guava/src/com/google/common/io/FileBackedOutputStream.java b/guava/src/com/google/common/io/FileBackedOutputStream.java -index b002561..23d427c 100644 +index 9912e2f..ef553a0 100644 --- a/guava/src/com/google/common/io/FileBackedOutputStream.java +++ b/guava/src/com/google/common/io/FileBackedOutputStream.java -@@ -14,6 +14,8 @@ +@@ -14,6 +14,7 @@ package com.google.common.io; +import static com.google.common.base.Preconditions.checkArgument; -+ + import static java.util.Objects.requireNonNull; + import com.google.common.annotations.Beta; - import com.google.common.annotations.GwtIncompatible; - import com.google.common.annotations.VisibleForTesting; -@@ -31,6 +33,14 @@ import java.io.OutputStream; +@@ -34,6 +35,14 @@ import javax.annotation.CheckForNull; * An {@link OutputStream} that starts buffering to a byte array, but switches to file buffering * once the data reaches a configurable size. * @@ -177,10 +175,18 @@ index b002561..23d427c 100644 + * href="https://github.com/google/guava/issues/2575">Guava issue 2575. TODO: b/283778848 - Fill + * in CVE number once it's available.) + * - *

This class is thread-safe. + *

Temporary files created by this stream may live in the local filesystem until either: * - * @author Chris Nokleberg -@@ -70,6 +80,7 @@ public final class FileBackedOutputStream extends OutputStream { + *