From 9e0844e95e2a6d21e38b88d755a7198ae0d50261 Mon Sep 17 00:00:00 2001 From: CentOS Sources Date: Tue, 27 Sep 2022 07:29:28 -0400 Subject: [PATCH] import postgresql-jdbc-42.2.14-1.el8 --- .gitignore | 3 +- .postgresql-jdbc.metadata | 3 +- SOURCES/disable-ConnectTimeoutTest.patch | 13 - SOURCES/fix-XXE-vulnerability.patch | 752 ----------------------- SPECS/postgresql-jdbc.spec | 101 +-- 5 files changed, 14 insertions(+), 858 deletions(-) delete mode 100644 SOURCES/disable-ConnectTimeoutTest.patch delete mode 100644 SOURCES/fix-XXE-vulnerability.patch diff --git a/.gitignore b/.gitignore index 72e3eef..2b66a39 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1 @@ -SOURCES/pgjdbc-REL42.2.3.tar.gz -SOURCES/pgjdbc-parent-poms-REL1.1.5.tar.gz +SOURCES/postgresql-42.2.14-src.tar.gz diff --git a/.postgresql-jdbc.metadata b/.postgresql-jdbc.metadata index 7b14bd1..87b9b95 100644 --- a/.postgresql-jdbc.metadata +++ b/.postgresql-jdbc.metadata @@ -1,2 +1 @@ -93681c950f1eccde132594ed6b63cce893bb7641 SOURCES/pgjdbc-REL42.2.3.tar.gz -7f8778fa0976d7991e8aaba887253ec204382477 SOURCES/pgjdbc-parent-poms-REL1.1.5.tar.gz +ad31bb1acc9d87a02e4ac72e0501c7accb144d7a SOURCES/postgresql-42.2.14-src.tar.gz diff --git a/SOURCES/disable-ConnectTimeoutTest.patch b/SOURCES/disable-ConnectTimeoutTest.patch deleted file mode 100644 index 420d6ab..0000000 --- a/SOURCES/disable-ConnectTimeoutTest.patch +++ /dev/null @@ -1,13 +0,0 @@ -diff --git a/pgjdbc/src/test/java/org/postgresql/test/jdbc2/Jdbc2TestSuite.java b/pgjdbc/src/test/java/org/postgresql/test/jdbc2/Jdbc2TestSuite.java -index 188183a..c0e4cca 100644 ---- a/pgjdbc/src/test/java/org/postgresql/test/jdbc2/Jdbc2TestSuite.java -+++ b/pgjdbc/src/test/java/org/postgresql/test/jdbc2/Jdbc2TestSuite.java -@@ -104,7 +104,7 @@ import org.junit.runners.Suite; - LoginTimeoutTest.class, - TestACL.class, - -- ConnectTimeoutTest.class, -+ // ConnectTimeoutTest.class, - - PGPropertyTest.class, - diff --git a/SOURCES/fix-XXE-vulnerability.patch b/SOURCES/fix-XXE-vulnerability.patch deleted file mode 100644 index d9c1656..0000000 --- a/SOURCES/fix-XXE-vulnerability.patch +++ /dev/null @@ -1,752 +0,0 @@ -From 3b2a73ad85da069637a73beca432950204535979 Mon Sep 17 00:00:00 2001 -From: Ondrej Dubaj -Date: Wed, 22 Jul 2020 11:39:42 +0200 -Subject: [PATCH] Fix for XXE vulnerability - -by defaulting to disabling external access and doc types. The -legacy insecure behavior can be restored via the new connection property xmlFactoryFactory -with a value of LEGACY_INSECURE. Alternatively, a custom class name can be specified that -implements org.postgresql.xml.PGXmlFactoryFactory and takes a no argument constructor. - -* refactor: Clean up whitespace in existing PgSQLXMLTest -* fix: Fix XXE vulnerability in PgSQLXML by disabling external access and doctypes -* fix: Add missing getter and setter for XML_FACTORY_FACTORY to BasicDataSource ---- - .../main/java/org/postgresql/PGProperty.java | 11 ++ - .../org/postgresql/core/BaseConnection.java | 9 ++ - .../postgresql/ds/common/BaseDataSource.java | 8 + - .../org/postgresql/jdbc/PgConnection.java | 41 +++++ - .../java/org/postgresql/jdbc/PgSQLXML.java | 44 +++--- - .../xml/DefaultPGXmlFactoryFactory.java | 141 ++++++++++++++++++ - .../xml/EmptyStringEntityResolver.java | 23 +++ - .../LegacyInsecurePGXmlFactoryFactory.java | 57 +++++++ - .../org/postgresql/xml/NullErrorHandler.java | 25 ++++ - .../postgresql/xml/PGXmlFactoryFactory.java | 30 ++++ - .../org/postgresql/jdbc/PgSQLXMLTest.java | 124 +++++++++++++++ - .../postgresql/test/jdbc2/Jdbc2TestSuite.java | 2 + - 12 files changed, 489 insertions(+), 26 deletions(-) - create mode 100644 pgjdbc/src/main/java/org/postgresql/xml/DefaultPGXmlFactoryFactory.java - create mode 100644 pgjdbc/src/main/java/org/postgresql/xml/EmptyStringEntityResolver.java - create mode 100644 pgjdbc/src/main/java/org/postgresql/xml/LegacyInsecurePGXmlFactoryFactory.java - create mode 100644 pgjdbc/src/main/java/org/postgresql/xml/NullErrorHandler.java - create mode 100644 pgjdbc/src/main/java/org/postgresql/xml/PGXmlFactoryFactory.java - create mode 100644 pgjdbc/src/test/java/org/postgresql/jdbc/PgSQLXMLTest.java - -diff --git a/pgjdbc/src/main/java/org/postgresql/PGProperty.java b/pgjdbc/src/main/java/org/postgresql/PGProperty.java -index e56e05e..7c2eed8 100644 ---- a/pgjdbc/src/main/java/org/postgresql/PGProperty.java -+++ b/pgjdbc/src/main/java/org/postgresql/PGProperty.java -@@ -331,6 +331,17 @@ public enum PGProperty { - */ - USE_SPNEGO("useSpnego", "false", "Use SPNEGO in SSPI authentication requests"), - -+ /** -+ * Factory class to instantiate factories for XML processing. -+ * The default factory disables external entity processing. -+ * Legacy behavior with external entity processing can be enabled by specifying a value of LEGACY_INSECURE. -+ * Or specify a custom class that implements {@code org.postgresql.xml.PGXmlFactoryFactory}. -+ */ -+ XML_FACTORY_FACTORY( -+ "xmlFactoryFactory", -+ "", -+ "Factory class to instantiate factories for XML processing"), -+ - /** - * Force one of - *