diff --git a/CVE-2023-22799.patch b/CVE-2023-22799.patch deleted file mode 100644 index 6384d95..0000000 --- a/CVE-2023-22799.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 3bc4349422e60f2235876a59dd415e98b072eb2b Mon Sep 17 00:00:00 2001 -From: Aaron Patterson -Date: Tue, 17 Jan 2023 13:32:28 -0800 -Subject: [PATCH] Fix ReDoS vulnerability in name parsing - -Thanks to @ooooooo_q for the patch! - -[CVE-2023-22799] ---- - lib/global_id/uri/gid.rb | 11 ++++------- - 1 file changed, 4 insertions(+), 7 deletions(-) - -diff --git a/lib/global_id/uri/gid.rb b/lib/global_id/uri/gid.rb -index f5d52dc..3fadf4f 100644 ---- a/lib/global_id/uri/gid.rb -+++ b/lib/global_id/uri/gid.rb -@@ -127,9 +127,6 @@ def set_params(params) - private - COMPONENT = [ :scheme, :app, :model_name, :model_id, :params ].freeze - -- # Extracts model_name and model_id from the URI path. -- PATH_REGEXP = %r(\A/([^/]+)/?([^/]+)?\z) -- - def check_host(host) - validate_component(host) - super -@@ -149,11 +146,11 @@ def check_scheme(scheme) - end - - def set_model_components(path, validate = false) -- _, model_name, model_id = path.match(PATH_REGEXP).to_a -- model_id = CGI.unescape(model_id) if model_id -- -+ _, model_name, model_id = path.split('/', 3) - validate_component(model_name) && validate_model_id(model_id, model_name) if validate - -+ model_id = CGI.unescape(model_id) if model_id -+ - @model_name = model_name - @model_id = model_id - end -@@ -166,7 +163,7 @@ def validate_component(component) - end - - def validate_model_id(model_id, model_name) -- return model_id unless model_id.blank? -+ return model_id unless model_id.blank? || model_id.include?('/') - - raise MissingModelIdError, "Unable to create a Global ID for " \ - "#{model_name} without a model id." diff --git a/globalid-1.0.0.gem b/globalid-1.0.0.gem deleted file mode 100644 index 6460707..0000000 Binary files a/globalid-1.0.0.gem and /dev/null differ diff --git a/globalid-1.2.1.gem b/globalid-1.2.1.gem new file mode 100644 index 0000000..daee538 Binary files /dev/null and b/globalid-1.2.1.gem differ diff --git a/rubygem-globalid.spec b/rubygem-globalid.spec index 37f7dcb..959603a 100644 --- a/rubygem-globalid.spec +++ b/rubygem-globalid.spec @@ -1,14 +1,13 @@ %global gem_name globalid %{?_with_bootstrap: %global bootstrap 1} Name: rubygem-%{gem_name} -Version: 1.0.0 -Release: 2 +Version: 1.2.1 +Release: 1 Summary: Refer to any model with a URI: gid://app/class/id License: MIT URL: https://github.com/rails/%{gem_name} Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem Source1: https://github.com/rails/%{gem_name}/archive/v%{version}.tar.gz -Patch0: CVE-2023-22799.patch BuildRequires: ruby(release) rubygems-devel ruby >= 1.9.3 %if ! 0%{?bootstrap} @@ -28,7 +27,6 @@ Documentation for %{name}. %prep %setup -q -n %{gem_name}-%{version} -b 1 -%patch0 -p1 %build gem build ../%{gem_name}-%{version}.gemspec @@ -62,6 +60,9 @@ popd %doc %{gem_instdir}/README.md %changelog +* Tue Nov 14 2023 wangkai <13474090681@163.com> - 1.2.1-1 +- Update to 1.2.1 + * Tue Feb 07 2023 liyuxiang - 1.0.0-2 - fix CVE-2023-22799 diff --git a/rubygem-globalid.yaml b/rubygem-globalid.yaml index 30472f7..ed124df 100644 --- a/rubygem-globalid.yaml +++ b/rubygem-globalid.yaml @@ -1,4 +1,4 @@ version_control: github src_repo: rails/globalid -tag_prefix: "globalid-" +tag_prefix: "^v" separator: "." diff --git a/v1.0.0.tar.gz b/v1.0.0.tar.gz deleted file mode 100644 index fecbacc..0000000 Binary files a/v1.0.0.tar.gz and /dev/null differ diff --git a/v1.2.1.tar.gz b/v1.2.1.tar.gz new file mode 100644 index 0000000..25e0915 Binary files /dev/null and b/v1.2.1.tar.gz differ