.gitignore

@@ -1,30 +1 @@
-/httpcomponents-client-4.0.3-src.tar.gz
+SOURCES/httpcomponents-client-4.5.10-src.tar.gz
-httpcomponents-client-4.1-src.tar.gz
-/httpcomponents-client-4.1.1-src.tar.gz
-/httpcomponents-client-4.1.2-src.tar.gz
-/httpcomponents-client-4.1.3-src.tar.gz
-/httpcomponents-client-4.2.3-src.tar.gz
-/httpcomponents-client-4.2.4-src.tar.gz
-/httpcomponents-client-4.2.5-src.tar.gz
-/httpcomponents-client-4.3-src.tar.gz
-/httpcomponents-client-4.3.1-src.tar.gz
-/httpcomponents-client-4.3.2-src.tar.gz
-/httpcomponents-client-4.3.3-src.tar.gz
-/httpcomponents-client-4.3.4-src.tar.gz
-/httpcomponents-client-4.3.5-src.tar.gz
-/httpcomponents-client-4.4-beta1-src.tar.gz
-/effective_tld_names.dat
-/httpcomponents-client-4.4-src.tar.gz
-/httpcomponents-client-4.4.1-src.tar.gz
-/httpcomponents-client-4.5-src.tar.gz
-/httpcomponents-client-4.5.1-src.tar.gz
-/httpcomponents-client-4.5.2-src.tar.gz
-/httpcomponents-client-4.5.3-src.tar.gz
-/httpcomponents-client-4.5.5-src.tar.gz
-/httpcomponents-client-4.5.6-src.tar.gz
-/httpcomponents-client-4.5.7-src.tar.gz
-/httpcomponents-client-4.5.8-src.tar.gz
-/httpcomponents-client-4.5.9-src.tar.gz
-/httpcomponents-client-4.5.10-src.tar.gz
-/httpcomponents-client-4.5.11-src.tar.gz
-/httpcomponents-client-4.5.13-src.tar.gz

.httpcomponents-client.metadata

@@ -0,0 +1 @@
+c3e525345e474f457b85d074a96865eaf5d397ad SOURCES/httpcomponents-client-4.5.10-src.tar.gz

SOURCES/0001-Use-system-copy-of-effective_tld_names.dat.patch

@@ -1,14 +1,14 @@
-From d9f08c36a39b035ec70a37cb6aac5f980cc57054 Mon Sep 17 00:00:00 2001
+From e1c756ba18432e60600c57370076761bf4774ee7 Mon Sep 17 00:00:00 2001
 From: Mikolaj Izdebski <mizdebsk@redhat.com>
 Date: Tue, 20 Jan 2015 16:04:31 +0100
-Subject: [PATCH 1/2] Use system copy of effective_tld_names.dat
+Subject: [PATCH 1/3] Use system copy of effective_tld_names.dat
 
 ---
  .../apache/http/conn/util/PublicSuffixMatcherLoader.java   | 7 +++----
  1 file changed, 3 insertions(+), 4 deletions(-)
 
 diff --git a/httpclient/src/main/java/org/apache/http/conn/util/PublicSuffixMatcherLoader.java b/httpclient/src/main/java/org/apache/http/conn/util/PublicSuffixMatcherLoader.java
-index 8783c5b..c858220 100644
+index 3d762c188..c7b5a7eb1 100644
 --- a/httpclient/src/main/java/org/apache/http/conn/util/PublicSuffixMatcherLoader.java
 +++ b/httpclient/src/main/java/org/apache/http/conn/util/PublicSuffixMatcherLoader.java
 @@ -82,11 +82,10 @@ public final class PublicSuffixMatcherLoader {
@@ -27,5 +27,5 @@ index 8783c5b..c858220 100644
                              // Should never happen
                              final Log log = LogFactory.getLog(PublicSuffixMatcherLoader.class);
 -- 
-2.19.1
+2.31.1
 

SOURCES/0002-Port-to-mockito-2.patch

@@ -1,7 +1,7 @@
-From 852a31061e2d46cc4bc1b5cfa388ed023de5095d Mon Sep 17 00:00:00 2001
+From e089dcee616e2fd37897e1a95492f581d1f6c939 Mon Sep 17 00:00:00 2001
 From: Mat Booth <mat.booth@redhat.com>
 Date: Fri, 7 Dec 2018 18:01:27 +0000
-Subject: [PATCH 2/2] Port to mockito 2
+Subject: [PATCH 2/3] Port to mockito 2
 
 Gets it building, but disables tests that are caused by change in
 behaviour of mockito that I didn't know how to fix
@@ -14,7 +14,7 @@ behaviour of mockito that I didn't know how to fix
  5 files changed, 8 insertions(+), 4 deletions(-)
 
 diff --git a/httpclient/src/test/java/org/apache/http/impl/client/integration/TestAbortHandling.java b/httpclient/src/test/java/org/apache/http/impl/client/integration/TestAbortHandling.java
-index 282e11b..0411caf 100644
+index 67f058ded..4a8cd1ab0 100644
 --- a/httpclient/src/test/java/org/apache/http/impl/client/integration/TestAbortHandling.java
 +++ b/httpclient/src/test/java/org/apache/http/impl/client/integration/TestAbortHandling.java
 @@ -288,6 +288,7 @@ public class TestAbortHandling extends LocalServerTestBase {
@@ -26,7 +26,7 @@ index 282e11b..0411caf 100644
          final HttpClientConnection conn = Mockito.mock(HttpClientConnection.class);
          final ConnectionRequest connrequest = Mockito.mock(ConnectionRequest.class);
 diff --git a/httpclient/src/test/java/org/apache/http/impl/client/integration/TestSPNegoScheme.java b/httpclient/src/test/java/org/apache/http/impl/client/integration/TestSPNegoScheme.java
-index f638031..31799cb 100644
+index f6380313e..31799cbc1 100644
 --- a/httpclient/src/test/java/org/apache/http/impl/client/integration/TestSPNegoScheme.java
 +++ b/httpclient/src/test/java/org/apache/http/impl/client/integration/TestSPNegoScheme.java
 @@ -150,6 +150,7 @@ public class TestSPNegoScheme extends LocalServerTestBase {
@@ -46,7 +46,7 @@ index f638031..31799cb 100644
          this.serverBootstrap.registerHandler("*", new PleaseNegotiateService());
          final HttpHost target = start();
 diff --git a/httpclient/src/test/java/org/apache/http/impl/execchain/TestMainClientExec.java b/httpclient/src/test/java/org/apache/http/impl/execchain/TestMainClientExec.java
-index 2261da8..e922155 100644
+index 7de9921e2..07b6bfccc 100644
 --- a/httpclient/src/test/java/org/apache/http/impl/execchain/TestMainClientExec.java
 +++ b/httpclient/src/test/java/org/apache/http/impl/execchain/TestMainClientExec.java
 @@ -402,6 +402,7 @@ public class TestMainClientExec {
@@ -65,7 +65,7 @@ index 2261da8..e922155 100644
 \ No newline at end of file
 +}
 diff --git a/httpclient/src/test/java/org/apache/http/impl/execchain/TestMinimalClientExec.java b/httpclient/src/test/java/org/apache/http/impl/execchain/TestMinimalClientExec.java
-index 9a96ba6..41eb023 100644
+index 9a96ba686..41eb0236f 100644
 --- a/httpclient/src/test/java/org/apache/http/impl/execchain/TestMinimalClientExec.java
 +++ b/httpclient/src/test/java/org/apache/http/impl/execchain/TestMinimalClientExec.java
 @@ -256,6 +256,7 @@ public class TestMinimalClientExec {
@@ -77,7 +77,7 @@ index 9a96ba6..41eb023 100644
          final HttpRoute route = new HttpRoute(target);
          final HttpClientContext context = new HttpClientContext();
 diff --git a/httpclient/src/test/java/org/apache/http/impl/execchain/TestRedirectExec.java b/httpclient/src/test/java/org/apache/http/impl/execchain/TestRedirectExec.java
-index 5621a3f..23506dc 100644
+index a5d0591da..78b1af440 100644
 --- a/httpclient/src/test/java/org/apache/http/impl/execchain/TestRedirectExec.java
 +++ b/httpclient/src/test/java/org/apache/http/impl/execchain/TestRedirectExec.java
 @@ -349,7 +349,7 @@ public class TestRedirectExec {
@@ -100,5 +100,5 @@ index 5621a3f..23506dc 100644
          }
  
 -- 
-2.19.1
+2.31.1
 

SOURCES/0003-Incorrect-handling-of-malformed-authority-component-.patch

@@ -0,0 +1,126 @@
+From 0ac5caeaed1fa0354e02e0609f2c726b1b72eb8c Mon Sep 17 00:00:00 2001
+From: Oleg Kalnichevski <olegk@apache.org>
+Date: Tue, 29 Sep 2020 09:37:38 +0200
+Subject: [PATCH 3/3] Incorrect handling of malformed authority component by
+ URIUtils#extractHost
+
+---
+ .../apache/http/client/utils/URIUtils.java    | 69 ++++++++-----------
+ .../http/client/utils/TestURIUtils.java       |  6 +-
+ 2 files changed, 32 insertions(+), 43 deletions(-)
+
+diff --git a/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java b/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java
+index 8eb7667e3..aa3431f6f 100644
+--- a/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java
++++ b/httpclient/src/main/java/org/apache/http/client/utils/URIUtils.java
+@@ -419,56 +419,43 @@ public class URIUtils {
+         if (uri == null) {
+             return null;
+         }
+-        HttpHost target = null;
+         if (uri.isAbsolute()) {
+-            int port = uri.getPort(); // may be overridden later
+-            String host = uri.getHost();
+-            if (host == null) { // normal parse failed; let's do it ourselves
++            if (uri.getHost() == null) { // normal parse failed; let's do it ourselves
+                 // authority does not seem to care about the valid character-set for host names
+-                host = uri.getAuthority();
+-                if (host != null) {
++                if (uri.getAuthority() != null) {
++                    String content = uri.getAuthority();
+                     // Strip off any leading user credentials
+-                    final int at = host.indexOf('@');
+-                    if (at >= 0) {
+-                        if (host.length() > at+1 ) {
+-                            host = host.substring(at+1);
+-                        } else {
+-                            host = null; // @ on its own
+-                        }
++                    int at = content.indexOf('@');
++                    if (at != -1) {
++                        content = content.substring(at + 1);
+                     }
+-                    // Extract the port suffix, if present
+-                    if (host != null) {
+-                        final int colon = host.indexOf(':');
+-                        if (colon >= 0) {
+-                            final int pos = colon + 1;
+-                            int len = 0;
+-                            for (int i = pos; i < host.length(); i++) {
+-                                if (Character.isDigit(host.charAt(i))) {
+-                                    len++;
+-                                } else {
+-                                    break;
+-                                }
+-                            }
+-                            if (len > 0) {
+-                                try {
+-                                    port = Integer.parseInt(host.substring(pos, pos + len));
+-                                } catch (final NumberFormatException ex) {
+-                                }
+-                            }
+-                            host = host.substring(0, colon);
++                    final String scheme = uri.getScheme();
++                    final String hostname;
++                    final int port;
++                    at = content.indexOf(":");
++                    if (at != -1) {
++                        hostname = content.substring(0, at);
++                        try {
++                            final String portText = content.substring(at + 1);
++                            port = !TextUtils.isEmpty(portText) ? Integer.parseInt(portText) : -1;
++                        } catch (final NumberFormatException ex) {
++                            return null;
+                         }
++                    } else {
++                        hostname = content;
++                        port = -1;
++                    }
++                    try {
++                        return new HttpHost(hostname, port, scheme);
++                    } catch (final IllegalArgumentException ex) {
++                        return null;
+                     }
+                 }
+-            }
+-            final String scheme = uri.getScheme();
+-            if (!TextUtils.isBlank(host)) {
+-                try {
+-                    target = new HttpHost(host, port, scheme);
+-                } catch (final IllegalArgumentException ignore) {
+-                }
++            } else {
++                return new HttpHost(uri.getHost(), uri.getPort(), uri.getScheme());
+             }
+         }
+-        return target;
++        return null;
+     }
+ 
+     /**
+diff --git a/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java b/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java
+index 189966635..98a44bc1c 100644
+--- a/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java
++++ b/httpclient/src/test/java/org/apache/http/client/utils/TestURIUtils.java
+@@ -273,14 +273,16 @@ public class TestURIUtils {
+ 
+         Assert.assertEquals(new HttpHost("localhost",8080),
+                 URIUtils.extractHost(new URI("http://localhost:8080/;sessionid=stuff/abcd")));
+-        Assert.assertEquals(new HttpHost("localhost",8080),
++        Assert.assertEquals(null,
+                 URIUtils.extractHost(new URI("http://localhost:8080;sessionid=stuff/abcd")));
+-        Assert.assertEquals(new HttpHost("localhost",-1),
++        Assert.assertEquals(null,
+                 URIUtils.extractHost(new URI("http://localhost:;sessionid=stuff/abcd")));
+         Assert.assertEquals(null,
+                 URIUtils.extractHost(new URI("http://:80/robots.txt")));
+         Assert.assertEquals(null,
+                 URIUtils.extractHost(new URI("http://some%20domain:80/robots.txt")));
++        Assert.assertEquals(null,
++                URIUtils.extractHost(new URI("http://blah@goggle.com:80@google.com/")));
+     }
+ 
+     @Test
+-- 
+2.31.1
+

SPECS/httpcomponents-client.spec

@@ -1,37 +1,39 @@
-%bcond_with bootstrap
-
 Name:              httpcomponents-client
 Summary:           HTTP agent implementation based on httpcomponents HttpCore
-Version:           4.5.13
+Version:           4.5.10
-Release:           5%{?dist}
+Release:           4%{?dist}
 License:           ASL 2.0
 URL:               http://hc.apache.org/
-Source0:           https://www.apache.org/dist/httpcomponents/httpclient/source/%{name}-%{version}-src.tar.gz
+Source0:           http://www.apache.org/dist/httpcomponents/httpclient/source/%{name}-%{version}-src.tar.gz
 BuildArch:         noarch
-ExclusiveArch:     %{java_arches} noarch
 
 Patch0:            0001-Use-system-copy-of-effective_tld_names.dat.patch
 Patch1:            0002-Port-to-mockito-2.patch
+Patch2:            0003-Incorrect-handling-of-malformed-authority-component-.patch
 
-%if %{with bootstrap}
-BuildRequires:  javapackages-bootstrap-openjdk8
-%else
 BuildRequires:     maven-local-openjdk8
-BuildRequires:     mvn(commons-codec:commons-codec)
+BuildRequires:     %{?module_prefix}mvn(commons-codec:commons-codec)
 BuildRequires:     mvn(commons-logging:commons-logging)
 BuildRequires:     mvn(junit:junit)
 BuildRequires:     mvn(org.apache.felix:maven-bundle-plugin)
 BuildRequires:     mvn(org.apache.httpcomponents:httpcomponents-parent:pom:)
-BuildRequires:     mvn(org.apache.httpcomponents:httpcore)
+BuildRequires:     %{?module_prefix}mvn(org.apache.httpcomponents:httpcore)
 BuildRequires:     mvn(org.codehaus.mojo:build-helper-maven-plugin)
 BuildRequires:     mvn(org.mockito:mockito-core)
+
+%if 0%{?module_prefix:1}
+%package -n %{module_prefix}%{name}
+Summary: %{summary}
 %endif
 
-%if %{without bootstrap}
 BuildRequires:     publicsuffix-list
-%endif
 Requires:          publicsuffix-list
 
+%if 0%{?module_prefix:1}
+%description -n %{module_prefix}%{name}
+%{summary}.
+%endif
+
 %description
 HttpClient is a HTTP/1.1 compliant HTTP agent implementation based on
 httpcomponents HttpCore. It also provides reusable components for
@@ -46,6 +48,7 @@ encouraged to upgrade.
 %setup -q -n %{name}-%{version}
 %patch0 -p1
 %patch1 -p1
+%patch2 -p1
 
 %mvn_package :::tests: __noinstall
 
@@ -125,64 +128,22 @@ rm httpclient/src/test/java/org/apache/http/client/config/TestRequestConfig.java
 %doc README.txt RELEASE_NOTES.txt
 
 %changelog
-* Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.13-5
+* Sat Sep 25 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.10-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
+- Fix incorrect handling of malformed authority component in request URIs
+- Resolves: CVE-2020-13956
 
-* Sat Feb 05 2022 Jiri Vanek <jvanek@redhat.com> - 4.5.13-4
+* Sat Jan 25 2020 Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.10-3
-- Rebuilt for java-17-openjdk as system jdk
-
-* Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.13-3
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
-* Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.13-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
-
-* Wed Jun 23 2021 Marian Koncek <mkoncek@redhat.com> - 4.5.13-1
-- Update to upstream version 4.5.13
-
-* Mon May 17 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.11-3
-- Bootstrap build
-- Non-bootstrap build
-
-* Wed Feb 17 2021 Fabio Valentini <decathorpe@gmail.com> - 4.5.10-6
-- Build with -release 8 for better OpenJDK 8 compatibility.
-
-* Tue Jan 26 2021 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.10-5
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild
-
-* Tue Jul 28 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.10-4
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild
-
-* Fri Jul 10 2020 Jiri Vanek <jvanek@redhat.com> - 4.5.10-3
-- Rebuilt for JDK-11, see https://fedoraproject.org/wiki/Changes/Java11
-
-* Wed Jan 29 2020 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.10-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild
-
-* Sat Jan 25 2020 Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.11-2
 - Build with OpenJDK 8
 
-* Wed Jan 22 2020 Marian Koncek <mkoncek@redhat.com> - 4.5.11-1
-- Update to upstream version 4.5.11
-
 * Tue Nov 05 2019 Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.10-2
 - Mass rebuild for javapackages-tools 201902
 
 * Mon Sep 16 2019 Marian Koncek <mkoncek@redhat.com> - 4.5.10-1
 - Update to upstream version 4.5.10
 
-* Mon Sep 16 2019 Marian Koncek <mkoncek@redhat.com> - 4.5.10-1
-- Update to upstream version 4.5.10
-
-* Thu Aug 29 2019 Fabio Valentini <decathorpe@gmail.com> - 4.5.7-3
-- Disable memcached and ehcache support.
-
 * Mon Jul 29 2019 Marian Koncek <mkoncek@redhat.com> - 4.5.9-1
 - Update to upstream version 4.5.9
 
-* Thu Jul 25 2019 Fedora Release Engineering <releng@fedoraproject.org> - 4.5.7-2
-- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild
-
 * Fri May 24 2019 Mikolaj Izdebski <mizdebsk@redhat.com> - 4.5.8-2
 - Mass rebuild for javapackages-tools 201901
 

sources

@@ -1 +0,0 @@
-SHA512 (httpcomponents-client-4.5.13-src.tar.gz) = 421e413fb2206fa95b6428ff067cdf2b440d2d3d4503cc3ca9bcf70ccd8ed1b8273ec4fe0703e6a8cd7612940b7ed966d9f163dbfeb8bf699ae2a8b2e0866d05