diff --git a/.gitignore b/.gitignore index b67c0e2..32d55e3 100644 --- a/.gitignore +++ b/.gitignore @@ -1,32 +1 @@ -/qtdeclarative-everywhere-src-6.0.0.tar.xz -/qtdeclarative-everywhere-src-6.0.1.tar.xz -/qtdeclarative-everywhere-src-6.0.3.tar.xz -/qtdeclarative-everywhere-src-6.1.0.tar.xz -/qtdeclarative-everywhere-src-6.1.1.tar.xz -/qtdeclarative-everywhere-src-6.1.2.tar.xz -/qtdeclarative-everywhere-src-6.2.0-beta3.tar.xz -/qtdeclarative-everywhere-src-6.2.0-beta4.tar.xz -/qtdeclarative-everywhere-src-6.2.0-rc.tar.xz -/qtdeclarative-everywhere-src-6.2.0-rc2.tar.xz -/qtdeclarative-everywhere-src-6.2.0.tar.xz -/qtdeclarative-everywhere-src-6.2.1.tar.xz -/qtdeclarative-everywhere-src-6.2.2.tar.xz -/qtdeclarative-everywhere-src-6.2.3.tar.xz -/qtdeclarative-everywhere-src-6.3.0.tar.xz -/qtdeclarative-everywhere-src-6.3.1.tar.xz -/qtdeclarative-everywhere-src-6.4.0.tar.xz -/qtdeclarative-everywhere-src-6.4.1.tar.xz -/qtdeclarative-everywhere-src-6.4.2.tar.xz -/qtdeclarative-everywhere-src-6.4.3.tar.xz -/qtdeclarative-everywhere-src-6.5.0.tar.xz -/qtdeclarative-everywhere-src-6.5.1.tar.xz -/qtdeclarative-everywhere-src-6.5.2.tar.xz -/qtdeclarative-everywhere-src-6.5.3.tar.xz -/qtdeclarative-everywhere-src-6.6.0.tar.xz -/qtdeclarative-everywhere-src-6.6.1.tar.xz -/qtdeclarative-everywhere-src-6.7.0.tar.xz -/qtdeclarative-everywhere-src-6.7.1.tar.xz -/qtdeclarative-everywhere-src-6.8.1.tar.xz -/qtdeclarative-everywhere-src-6.9.0.tar.xz -/qtdeclarative-everywhere-src-6.9.1.tar.xz -/qtdeclarative-everywhere-src-6.10.1.tar.xz +qtdeclarative-everywhere-src-6.10.1.tar.xz diff --git a/qtdeclarative-vectorimage-sanitize-source-string-used-in-output.patch b/VectorImage-Sanitize-source-string-used-in-output.patch similarity index 70% rename from qtdeclarative-vectorimage-sanitize-source-string-used-in-output.patch rename to VectorImage-Sanitize-source-string-used-in-output.patch index a0040b5..25c013b 100644 --- a/qtdeclarative-vectorimage-sanitize-source-string-used-in-output.patch +++ b/VectorImage-Sanitize-source-string-used-in-output.patch @@ -1,24 +1,27 @@ From 1f35339b03fcb8787028e1301012a559328815fb Mon Sep 17 00:00:00 2001 From: Eskil Abrahamsen Blomfeldt -Date: Tue, 09 Dec 2025 07:39:32 +0100 +Date: Tue, 9 Dec 2025 07:39:32 +0100 Subject: [PATCH] VectorImage: Sanitize source string used in output -The source string is used as an object name in the output, so it gets -sanitized to prevent illegal characters. While SVG already mandates a -limited character set, rather than relying on the parser, sanitization -happens before passing to the generator -- consistent with how the -Lottie visitor handles it. +The source string is used as an object name in output, so we sanitize +it to make sure it does not contain illegal characters. SVG already +mandates a limited character set here, but rather than trust the parser +we sanitize before passing to the generator, similar to what the Lottie +visitor does. Fixes: QTBUG-142556 Pick-to: 6.8 Change-Id: I0684e726ab69a0735dcb5f91369b090d58a90b7b Reviewed-by: Eirik Aavitsland +(cherry picked from commit cfc3e783fed4e876c2c29d008b5ef43c547b16b7) +(cherry picked from commit ce82a78b0d10703f9b172f9afeb3d5e832e05074) +Reviewed-by: Qt Cherry-pick Bot --- .../generator/qsvgvisitorimpl.cpp | 20 ++++++++++++++++++- 1 file changed, 19 insertions(+), 1 deletion(-) diff --git a/src/quickvectorimage/generator/qsvgvisitorimpl.cpp b/src/quickvectorimage/generator/qsvgvisitorimpl.cpp -index 87ce1e80..b7c0dbfe 100644 +index 87ce1e80..fa04daea 100644 --- a/src/quickvectorimage/generator/qsvgvisitorimpl.cpp +++ b/src/quickvectorimage/generator/qsvgvisitorimpl.cpp @@ -1101,9 +1101,27 @@ void QSvgVisitorImpl::visitDocumentNodeEnd(const QSvgTinyDocument *node) @@ -30,7 +33,7 @@ index 87ce1e80..b7c0dbfe 100644 + QString res(raw.left(80)); + + if (!res.isEmpty()) { -+ constexpr QLatin1StringView legalSymbols("_-.:"); ++ constexpr QLatin1StringView legalSymbols("_-.:"); // Only valid SVG id characters + qsizetype i = 0; + do { + if (res.at(i).isLetterOrNumber() || legalSymbols.contains(res.at(i))) @@ -51,5 +54,4 @@ index 87ce1e80..b7c0dbfe 100644 info.isDefaultTransform = node->style().transform.isDefault(); info.transform.setDefaultValue(QVariant::fromValue(!info.isDefaultTransform -- -2.53.0 - +2.48.1 diff --git a/gating.yaml b/gating.yaml deleted file mode 100644 index d353613..0000000 --- a/gating.yaml +++ /dev/null @@ -1,6 +0,0 @@ ---- !Policy -product_versions: - - rhel-10 -decision_context: osci_compose_gate -rules: - - !PassingTestCaseRule {test_case_name: desktop-qe.desktop-ci.tier1-gating.functional} diff --git a/qt6-qtdeclarative.spec b/qt6-qtdeclarative.spec index 7685cd9..ee667ba 100644 --- a/qt6-qtdeclarative.spec +++ b/qt6-qtdeclarative.spec @@ -17,7 +17,7 @@ Summary: Qt6 - QtDeclarative component Name: qt6-%{qt_module} Version: 6.10.1 -Release: 2%{?dist} +Release: 1%{?dist}.1 License: LGPL-3.0-only OR GPL-3.0-only WITH Qt-GPL-exception-1.0 Url: http://www.qt.io @@ -40,7 +40,9 @@ Patch0: qtdeclarative-quickshapes-make-module-public.patch # CVE-2025-14576 # https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273 -Patch1: qtdeclarative-vectorimage-sanitize-source-string-used-in-output.patch +Patch1: VectorImage-Sanitize-source-string-used-in-output.patch + +## upstreamable patches # filter qml provides %global __provides_exclude_from ^%{_qt6_qmldir}/.*\\.so$ @@ -771,9 +773,9 @@ make check -k -C tests ||: %endif %changelog -* Tue May 19 2026 Jan Grulich - 6.10.1-2 +* Wed May 20 2026 Jan Grulich - 6.10.1-1.1 - VectorImage: sanitize source string used in output (CVE-2025-14576) - Resolves: RHEL-173495 + Resolves: RHEL-173494 * Mon Nov 24 2025 Jan Grulich - 6.10.1-1 - 6.10.1 diff --git a/rpminspect.yaml b/rpminspect.yaml deleted file mode 100644 index 010aeb1..0000000 --- a/rpminspect.yaml +++ /dev/null @@ -1,13 +0,0 @@ ---- -ignore: - - '/usr/lib*/qt6/tests/*' -annocheck: - # QT is known not to work properly with LTO at this point. Some of the issues - # are being worked on upstream and disabling LTO should be re-evaluated as - # we update this change. Until such time... - # Disable LTO - jobs: - hardened: --skip-lto - ignore: - - '/usr/lib*/qt6/examples/*' -