.gitignore

@@ -1 +1 @@
-SOURCES/plexus-utils-3.3.0.tar.gz
+SOURCES/plexus-utils-3.1.0.tar.gz

.plexus-utils.metadata

@@ -1 +1 @@
-31ff15c239124e2bd54dd63f39819807995a59fb SOURCES/plexus-utils-3.3.0.tar.gz
+bde480ebdca31097e8a70e8c0760bb2cac34baa1 SOURCES/plexus-utils-3.1.0.tar.gz

SOURCES/0001-Follow-symlinks-in-NioFiles.copy.patch

@@ -0,0 +1,25 @@
+From 978fcb3b207d1b1a9895dadd40ba31c290c57918 Mon Sep 17 00:00:00 2001
+From: Michael Simacek <msimacek@redhat.com>
+Date: Wed, 11 Jul 2018 13:15:55 +0200
+Subject: [PATCH] Follow symlinks in NioFiles.copy
+
+---
+ src/main/java/org/codehaus/plexus/util/NioFiles.java | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/src/main/java/org/codehaus/plexus/util/NioFiles.java b/src/main/java/org/codehaus/plexus/util/NioFiles.java
+index 2841978..50cdeb7 100644
+--- a/src/main/java/org/codehaus/plexus/util/NioFiles.java
++++ b/src/main/java/org/codehaus/plexus/util/NioFiles.java
+@@ -138,7 +138,7 @@ public static File copy( File source, File target )
+         throws IOException
+     {
+         Path copy = Files.copy( source.toPath(), target.toPath(), StandardCopyOption.REPLACE_EXISTING,
+-                                StandardCopyOption.COPY_ATTRIBUTES, LinkOption.NOFOLLOW_LINKS );
++                                StandardCopyOption.COPY_ATTRIBUTES );
+         return copy.toFile();
+     }
+ 
+-- 
+2.17.1
+

SOURCES/CVE-2025-67030.patch

@@ -0,0 +1,25 @@
+--- a/src/main/java/org/codehaus/plexus/util/Expand.java	2026-05-20 09:19:51.014184013 +0000
++++ b/src/main/java/org/codehaus/plexus/util/Expand.java	2026-05-20 09:20:05.847146005 +0000
+@@ -116,9 +116,20 @@
+     {
+         File f = FileUtils.resolveFile( dir, entryName );
+ 
+-        if ( !f.getAbsolutePath().startsWith( dir.getAbsolutePath() ) )
++        try
++        {
++            String canonicalDirPath = dir.getCanonicalPath();
++            String canonicalFilePath = f.getCanonicalPath();
++
++            if ( !canonicalFilePath.startsWith( canonicalDirPath + File.separator )
++                    && !canonicalFilePath.equals( canonicalDirPath ) )
++            {
++                throw new IOException( "Entry '" + entryName + "' outside the target directory." );
++            }
++        }
++        catch ( IOException e )
+         {
+-            throw new IOException( "Entry '" + entryName + "' outside the target directory." );
++            throw new IOException( "Failed to verify entry path for '" + entryName + "'", e );
+         }
+ 
+         try

SPECS/plexus-utils.spec

@@ -1,6 +1,6 @@
 Name:           plexus-utils
-Version:        3.3.0
+Version:        3.1.0
-Release:        3%{?dist}
+Release:        3%{?dist}.1
 Summary:        Plexus Common Utilities
 # ASL 1.1: several files in src/main/java/org/codehaus/plexus/util/ 
 # xpp: src/main/java/org/codehaus/plexus/util/xml/pull directory
@@ -17,7 +17,11 @@ BuildArch:      noarch
 Source0:        https://github.com/codehaus-plexus/%{name}/archive/%{name}-%{version}.tar.gz
 Source1:        http://apache.org/licenses/LICENSE-2.0.txt
 
-BuildRequires:  maven-local-openjdk8
+# https://github.com/codehaus-plexus/plexus-utils/issues/45
+Patch1:         0001-Follow-symlinks-in-NioFiles.copy.patch
+Patch2:         CVE-2025-67030.patch
+
+BuildRequires:  maven-local
 BuildRequires:  mvn(org.apache.felix:maven-bundle-plugin)
 BuildRequires:  mvn(org.apache.maven.plugins:maven-enforcer-plugin)
 BuildRequires:  mvn(org.codehaus.plexus:plexus:pom:)
@@ -30,12 +34,18 @@ reusable components for hibernate, form processing, jndi, i18n,
 velocity, etc. Plexus also includes an application server which
 is like a J2EE application server, without all the baggage.
 
-%{?module_package}
+%package javadoc
-%{?javadoc_package}
+Summary:          Javadoc for %{name}
+
+%description javadoc
+Javadoc for %{name}.
 
 %prep
 %setup -q -n %{name}-%{name}-%{version}
 
+%patch1 -p1
+%patch -P2 -p1
+
 cp %{SOURCE1} .
 
 %mvn_file : plexus/utils
@@ -62,27 +72,16 @@ cp %{SOURCE1} .
 %install
 %mvn_install
 
-%files -n %{?module_prefix}%{name} -f .mfiles
+%files -f .mfiles
-%license NOTICE.txt LICENSE-2.0.txt
+%doc NOTICE.txt LICENSE-2.0.txt
+
+%files javadoc -f .mfiles-javadoc
+%doc NOTICE.txt LICENSE-2.0.txt
 
 %changelog
-* Sat Jan 25 2020 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.3.0-3
+* Tue May 20 2025 Jacek Migacz <jmigacz@redhat.com> - 3.1.0-3.el8_10.1
-- Build with OpenJDK 8
+- Fix CVE-2025-67030: Directory Traversal in Expand.extractFile
-
+  Resolves: RHEL-165338
-* Tue Nov 05 2019 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.3.0-2
-- Mass rebuild for javapackages-tools 201902
-
-* Wed Oct 23 2019 Marian Koncek <mkoncek@redhat.com> - 3.3.0-1
-- Update to upstream verssion 3.3.0
-
-* Mon Jul 29 2019 Marian Koncek <mkoncek@redhat.com> - 3.2.1-1
-- Update to upstream version 3.2.1
-
-* Fri May 24 2019 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.2.0-2
-- Mass rebuild for javapackages-tools 201901
-
-* Sat Apr 13 2019 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.2.0-1
-- Update to upstream version 3.2.0
 
 * Fri Jul 13 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.1.0-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild