diff --git a/.gitignore b/.gitignore index 1614bcb..3973815 100644 --- a/.gitignore +++ b/.gitignore @@ -23,3 +23,4 @@ /kramdown-2.1.0.gem /kramdown-2.2.1.gem /kramdown-2.3.0.gem +/kramdown-2.3.1.gem diff --git a/rubygem-kramdown-2.2.1-rouge-3_26_0-testsuite.patch b/rubygem-kramdown-2.2.1-rouge-3_26_0-testsuite.patch deleted file mode 100644 index ebc8bf1..0000000 --- a/rubygem-kramdown-2.2.1-rouge-3_26_0-testsuite.patch +++ /dev/null @@ -1,35 +0,0 @@ -From e1beb51af7fe4ecb85dbab7328f47a23c86c7df2 Mon Sep 17 00:00:00 2001 -From: Thomas Leitner -Date: Wed, 6 Jan 2021 16:05:10 +0100 -Subject: [PATCH] Fix failing tests due to changes in rouge - ---- - Rakefile | 2 +- - test/testcases/block/06_codeblock/rouge/multiple.html | 2 +- - test/testcases/block/06_codeblock/rouge/simple.html | 2 +- - 3 files changed, 3 insertions(+), 3 deletions(-) - -diff --git a/test/testcases/block/06_codeblock/rouge/multiple.html b/test/testcases/block/06_codeblock/rouge/multiple.html -index 03eddb47..6ece5432 100644 ---- a/test/testcases/block/06_codeblock/rouge/multiple.html -+++ b/test/testcases/block/06_codeblock/rouge/multiple.html -@@ -6,6 +6,6 @@ - - - --
$foo = new Bar;
-+
$foo = new Bar;
- 
-
-diff --git a/test/testcases/block/06_codeblock/rouge/simple.html b/test/testcases/block/06_codeblock/rouge/simple.html -index 10f280a3..1c2259af 100644 ---- a/test/testcases/block/06_codeblock/rouge/simple.html -+++ b/test/testcases/block/06_codeblock/rouge/simple.html -@@ -5,6 +5,6 @@ -
-
- --
$foo = new Bar;
-+
$foo = new Bar;
- 
-
diff --git a/rubygem-kramdown-2.3.x-restrict-rouge-formatter-namespace-CVE-2021-28834.patch b/rubygem-kramdown-2.3.x-restrict-rouge-formatter-namespace-CVE-2021-28834.patch deleted file mode 100644 index fd31cb3..0000000 --- a/rubygem-kramdown-2.3.x-restrict-rouge-formatter-namespace-CVE-2021-28834.patch +++ /dev/null @@ -1,70 +0,0 @@ -From d6a1cbcb2caa2f8a70927f176070d126b2422760 Mon Sep 17 00:00:00 2001 -From: Stan Hu -Date: Sun, 14 Mar 2021 11:21:00 -0700 -Subject: [PATCH] Restrict Rouge formatters to Rouge::Formatters namespace - -ff0218a added support for specifying custom Rouge formatters with the -constraint that the formatter be in theRouge::Formatters namespace, but -it did not actually enforce this constraint. For example, this is valid: - -```ruby -Rouge::Formatters.const_get('CSV') -=> CSV -``` - -Adding the `false` parameter to `const_get` prevents this: - -```ruby -Rouge::Formatters.const_get('CSV', false) -NameError: uninitialized constant Rouge::Formatters::CSV -``` ---- - .../converter/syntax_highlighter/rouge.rb | 2 +- - test/test_files.rb | 18 +++++++++++------- - 2 files changed, 12 insertions(+), 8 deletions(-) - -diff --git a/lib/kramdown/converter/syntax_highlighter/rouge.rb b/lib/kramdown/converter/syntax_highlighter/rouge.rb -index c799526c..ed6a4f83 100644 ---- a/lib/kramdown/converter/syntax_highlighter/rouge.rb -+++ b/lib/kramdown/converter/syntax_highlighter/rouge.rb -@@ -70,7 +70,7 @@ def self.formatter_class(opts = {}) - when Class - formatter - when /\A[[:upper:]][[:alnum:]_]*\z/ -- ::Rouge::Formatters.const_get(formatter) -+ ::Rouge::Formatters.const_get(formatter, false) - else - # Available in Rouge 2.0 or later - ::Rouge::Formatters::HTMLLegacy -diff --git a/test/test_files.rb b/test/test_files.rb -index b446b3bc..7e2ccad3 100644 ---- a/test/test_files.rb -+++ b/test/test_files.rb -@@ -21,16 +21,20 @@ - end - - # custom formatter for tests -- class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class -+ module Rouge -+ module Formatters -+ class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class - -- tag 'rouge_html_formatters' -+ tag 'rouge_html_formatters' - -- def stream(tokens, &b) -- yield %(
) -- super -- yield %(
) -- end -+ def stream(tokens, &b) -+ yield %(
) -+ super -+ yield %(
) -+ end - -+ end -+ end - end - rescue LoadError, SyntaxError, NameError - end diff --git a/rubygem-kramdown.spec b/rubygem-kramdown.spec index 2cb4a3c..a283a22 100644 --- a/rubygem-kramdown.spec +++ b/rubygem-kramdown.spec @@ -2,18 +2,13 @@ %global gem_name kramdown Name: rubygem-%{gem_name} -Version: 2.3.0 -Release: 3%{?dist} +Version: 2.3.1 +Release: 1%{?dist} Summary: Fast, pure-Ruby Markdown-superset converter License: MIT URL: http://kramdown.rubyforge.org Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem -# https://github.com/gettalong/kramdown/commit/e1beb51af7fe4ecb85dbab7328f47a23c86c7df2 -Patch2: rubygem-kramdown-2.2.1-rouge-3_26_0-testsuite.patch -# https://github.com/gettalong/kramdown/pull/708 -# From: https://github.com/gettalong/kramdown/commit/d6a1cbcb2caa2f8a70927f176070d126b2422760 -Patch3: rubygem-kramdown-2.3.x-restrict-rouge-formatter-namespace-CVE-2021-28834.patch BuildRequires: ruby(release) BuildRequires: rubygems-devel BuildRequires: rubygem(minitest) >= 5 @@ -52,8 +47,6 @@ Documentation for %{name} %prep %setup -q -n %{gem_name}-%{version} -%patch2 -p1 -%patch3 -p1 mv ../%{gem_name}-%{version}.gemspec . %build @@ -113,6 +106,9 @@ popd %doc %{gem_docdir} %changelog +* Sun Mar 21 2021 Mamoru TASAKA - 2.3.0-1 +- 2.3.1 + * Sun Mar 21 2021 Mamoru TASAKA - 2.3.0-3 - Apply upstream fix for CVE-2021-28834 (rouge formatter namespace restriction) diff --git a/sources b/sources index 7e24ab4..15d73b4 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (kramdown-2.3.0.gem) = a3ed8360de9208d5ce658d198763737826db943d23dda7ca9cfd507a4656c39f2b19ece78af87981b1177fe01690d6647c854092b230cf3a8a7d2823dc83d276 +SHA512 (kramdown-2.3.1.gem) = d1955065e3c5d7a60e595b647d5e453cf07a08fe25d40c67cf6f32d30f704a2c653a52959f8c71b3290e6da74836a085fa6bf8201c878303ad572dee8cc64496