ruby/rubygem-rexml-3.3.9-Fix-ReDoS-CVE-2024-49761.patch
Jarek Prokop 6767a4e791 Fix REXML ReDoS vulnerability. (CVE-2024-49761)
Tests not included in the patch, this Ruby version does not include
rexml unit tests in the released tarball.

Before patch application, enter the correct directory in the specfile.
Instead of adjusting the path in the patch for each ruby version we can
enter the correct directory first in the specfile and make use of
%rexml_version macro which further helps in making minimal changes
for different ruby versions.

Resolves: RHEL-68525
2024-12-02 16:17:33 +01:00

32 lines
1.1 KiB
Diff

From ce59f2eb1aeb371fe1643414f06618dbe031979f Mon Sep 17 00:00:00 2001
From: Sutou Kouhei <kou@clear-code.com>
Date: Thu, 24 Oct 2024 14:45:31 +0900
Subject: [PATCH] parser: fix a bug that &#0x...; is accepted as a character
reference
---
lib/rexml/parsers/baseparser.rb | 10 +++++++---
test/parse/test_character_reference.rb | 6 ++++++
2 files changed, 13 insertions(+), 3 deletions(-)
diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
index 7bd8adf..b4547ba 100644
--- a/lib/rexml/parsers/baseparser.rb
+++ b/lib/rexml/parsers/baseparser.rb
@@ -469,8 +469,12 @@ def unnormalize( string, entities=nil, filter=nil )
return rv if matches.size == 0
- rv.gsub!( /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/ ) {
+ rv.gsub!( /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ ) {
m=$1
- m = "0#{m}" if m[0] == ?x
- [Integer(m)].pack('U*')
+ if m.start_with?("x")
+ code_point = Integer(m[1..-1], 16)
+ else
+ code_point = Integer(m, 10)
+ end
+ [code_point].pack('U*')
}
matches.collect!{|x|x[0]}.compact!
if matches.size > 0