This commit is contained in:
Mamoru TASAKA 2021-03-21 16:25:21 +09:00
parent 8382667464
commit a2769f11b9
5 changed files with 7 additions and 115 deletions

1
.gitignore vendored
View File

@ -23,3 +23,4 @@
/kramdown-2.1.0.gem
/kramdown-2.2.1.gem
/kramdown-2.3.0.gem
/kramdown-2.3.1.gem

View File

@ -1,35 +0,0 @@
From e1beb51af7fe4ecb85dbab7328f47a23c86c7df2 Mon Sep 17 00:00:00 2001
From: Thomas Leitner <t_leitner@gmx.at>
Date: Wed, 6 Jan 2021 16:05:10 +0100
Subject: [PATCH] Fix failing tests due to changes in rouge
---
Rakefile | 2 +-
test/testcases/block/06_codeblock/rouge/multiple.html | 2 +-
test/testcases/block/06_codeblock/rouge/simple.html | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/test/testcases/block/06_codeblock/rouge/multiple.html b/test/testcases/block/06_codeblock/rouge/multiple.html
index 03eddb47..6ece5432 100644
--- a/test/testcases/block/06_codeblock/rouge/multiple.html
+++ b/test/testcases/block/06_codeblock/rouge/multiple.html
@@ -6,6 +6,6 @@
</code></pre>
</div></div></div>
-<div class="language-php highlighter-rouge"><div class="custom-class"><div class="highlight"><pre class="highlight"><code><span class="nv">$foo</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">Bar</span><span class="p">;</span>
+<div class="language-php highlighter-rouge"><div class="custom-class"><div class="highlight"><pre class="highlight"><code><span class="nv">$foo</span> <span class="o">=</span> <span class="k">new</span> <span class="nc">Bar</span><span class="p">;</span>
</code></pre>
</div></div></div>
diff --git a/test/testcases/block/06_codeblock/rouge/simple.html b/test/testcases/block/06_codeblock/rouge/simple.html
index 10f280a3..1c2259af 100644
--- a/test/testcases/block/06_codeblock/rouge/simple.html
+++ b/test/testcases/block/06_codeblock/rouge/simple.html
@@ -5,6 +5,6 @@
</code></pre>
</div></div>
-<div class="language-php highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">$foo</span> <span class="o">=</span> <span class="k">new</span> <span class="nx">Bar</span><span class="p">;</span>
+<div class="language-php highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="nv">$foo</span> <span class="o">=</span> <span class="k">new</span> <span class="nc">Bar</span><span class="p">;</span>
</code></pre>
</div></div>

View File

@ -1,70 +0,0 @@
From d6a1cbcb2caa2f8a70927f176070d126b2422760 Mon Sep 17 00:00:00 2001
From: Stan Hu <stanhu@gmail.com>
Date: Sun, 14 Mar 2021 11:21:00 -0700
Subject: [PATCH] Restrict Rouge formatters to Rouge::Formatters namespace
ff0218a added support for specifying custom Rouge formatters with the
constraint that the formatter be in theRouge::Formatters namespace, but
it did not actually enforce this constraint. For example, this is valid:
```ruby
Rouge::Formatters.const_get('CSV')
=> CSV
```
Adding the `false` parameter to `const_get` prevents this:
```ruby
Rouge::Formatters.const_get('CSV', false)
NameError: uninitialized constant Rouge::Formatters::CSV
```
---
.../converter/syntax_highlighter/rouge.rb | 2 +-
test/test_files.rb | 18 +++++++++++-------
2 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/lib/kramdown/converter/syntax_highlighter/rouge.rb b/lib/kramdown/converter/syntax_highlighter/rouge.rb
index c799526c..ed6a4f83 100644
--- a/lib/kramdown/converter/syntax_highlighter/rouge.rb
+++ b/lib/kramdown/converter/syntax_highlighter/rouge.rb
@@ -70,7 +70,7 @@ def self.formatter_class(opts = {})
when Class
formatter
when /\A[[:upper:]][[:alnum:]_]*\z/
- ::Rouge::Formatters.const_get(formatter)
+ ::Rouge::Formatters.const_get(formatter, false)
else
# Available in Rouge 2.0 or later
::Rouge::Formatters::HTMLLegacy
diff --git a/test/test_files.rb b/test/test_files.rb
index b446b3bc..7e2ccad3 100644
--- a/test/test_files.rb
+++ b/test/test_files.rb
@@ -21,16 +21,20 @@
end
# custom formatter for tests
- class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class
+ module Rouge
+ module Formatters
+ class RougeHTMLFormatters < Kramdown::Converter::SyntaxHighlighter::Rouge.formatter_class
- tag 'rouge_html_formatters'
+ tag 'rouge_html_formatters'
- def stream(tokens, &b)
- yield %(<div class="custom-class">)
- super
- yield %(</div>)
- end
+ def stream(tokens, &b)
+ yield %(<div class="custom-class">)
+ super
+ yield %(</div>)
+ end
+ end
+ end
end
rescue LoadError, SyntaxError, NameError
end

View File

@ -2,18 +2,13 @@
%global gem_name kramdown
Name: rubygem-%{gem_name}
Version: 2.3.0
Release: 3%{?dist}
Version: 2.3.1
Release: 1%{?dist}
Summary: Fast, pure-Ruby Markdown-superset converter
License: MIT
URL: http://kramdown.rubyforge.org
Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem
# https://github.com/gettalong/kramdown/commit/e1beb51af7fe4ecb85dbab7328f47a23c86c7df2
Patch2: rubygem-kramdown-2.2.1-rouge-3_26_0-testsuite.patch
# https://github.com/gettalong/kramdown/pull/708
# From: https://github.com/gettalong/kramdown/commit/d6a1cbcb2caa2f8a70927f176070d126b2422760
Patch3: rubygem-kramdown-2.3.x-restrict-rouge-formatter-namespace-CVE-2021-28834.patch
BuildRequires: ruby(release)
BuildRequires: rubygems-devel
BuildRequires: rubygem(minitest) >= 5
@ -52,8 +47,6 @@ Documentation for %{name}
%prep
%setup -q -n %{gem_name}-%{version}
%patch2 -p1
%patch3 -p1
mv ../%{gem_name}-%{version}.gemspec .
%build
@ -113,6 +106,9 @@ popd
%doc %{gem_docdir}
%changelog
* Sun Mar 21 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.3.0-1
- 2.3.1
* Sun Mar 21 2021 Mamoru TASAKA <mtasaka@fedoraproject.org> - 2.3.0-3
- Apply upstream fix for CVE-2021-28834 (rouge formatter namespace restriction)

View File

@ -1 +1 @@
SHA512 (kramdown-2.3.0.gem) = a3ed8360de9208d5ce658d198763737826db943d23dda7ca9cfd507a4656c39f2b19ece78af87981b1177fe01690d6647c854092b230cf3a8a7d2823dc83d276
SHA512 (kramdown-2.3.1.gem) = d1955065e3c5d7a60e595b647d5e453cf07a08fe25d40c67cf6f32d30f704a2c653a52959f8c71b3290e6da74836a085fa6bf8201c878303ad572dee8cc64496