import CS yelp-40.3-3.el9
This commit is contained in:
parent
8107f625a2
commit
2a68109de7
118
SOURCES/yelp-CVE-2025-3155.patch
Normal file
118
SOURCES/yelp-CVE-2025-3155.patch
Normal file
@ -0,0 +1,118 @@
|
|||||||
|
From 7ecd58dc0ca7bf9d0acb00bf04194a0cb6e8b724 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Shaun McCance <shaunm@gnome.org>
|
||||||
|
Date: Fri, 18 Apr 2025 11:33:01 -0400
|
||||||
|
Subject: [PATCH] Initial fix for CVE-2025-3155 from parrot409
|
||||||
|
|
||||||
|
https://gitlab.gnome.org/GNOME/yelp/-/issues/221
|
||||||
|
---
|
||||||
|
data/xslt/mal2html.xsl.in | 5 +++++
|
||||||
|
data/xslt/man2html.xsl.in | 2 +-
|
||||||
|
data/xslt/yelp-common.xsl.in | 7 +++++++
|
||||||
|
libyelp/yelp-transform.c | 19 +++++++++++++++++++
|
||||||
|
libyelp/yelp-view.c | 2 +-
|
||||||
|
5 files changed, 33 insertions(+), 2 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/data/xslt/mal2html.xsl.in b/data/xslt/mal2html.xsl.in
|
||||||
|
index 9e44b734..0a74da55 100644
|
||||||
|
--- a/data/xslt/mal2html.xsl.in
|
||||||
|
+++ b/data/xslt/mal2html.xsl.in
|
||||||
|
@@ -19,6 +19,11 @@
|
||||||
|
<xsl:param name="mal.link.prefix" select="'xref:'"/>
|
||||||
|
<xsl:param name="mal.link.extension" select="''"/>
|
||||||
|
|
||||||
|
+<xsl:template name="html.head.top.custom">
|
||||||
|
+ <xsl:param name="node" select="."/>
|
||||||
|
+ <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'nonce-{$html.csp.nonce}'; "/>
|
||||||
|
+</xsl:template>
|
||||||
|
+
|
||||||
|
<xsl:template name="mal.link.target.custom">
|
||||||
|
<xsl:param name="node" select="."/>
|
||||||
|
<xsl:param name="action" select="$node/@action"/>
|
||||||
|
diff --git a/data/xslt/man2html.xsl.in b/data/xslt/man2html.xsl.in
|
||||||
|
index 676ce3eb..56bc1f5c 100644
|
||||||
|
--- a/data/xslt/man2html.xsl.in
|
||||||
|
+++ b/data/xslt/man2html.xsl.in
|
||||||
|
@@ -131,7 +131,7 @@
|
||||||
|
the correct styling and a single character which we measure the
|
||||||
|
width of and update each sheet as required.
|
||||||
|
-->
|
||||||
|
-<script type="text/javascript" language="javascript">
|
||||||
|
+<script type="text/javascript" language="javascript" nonce="{$html.csp.nonce}">
|
||||||
|
<xsl:text>
|
||||||
|
$(document).ready (function () {
|
||||||
|
var div = document.getElementById("invisible-char");
|
||||||
|
diff --git a/data/xslt/yelp-common.xsl.in b/data/xslt/yelp-common.xsl.in
|
||||||
|
index 0c1ec9bb..421fc02d 100644
|
||||||
|
--- a/data/xslt/yelp-common.xsl.in
|
||||||
|
+++ b/data/xslt/yelp-common.xsl.in
|
||||||
|
@@ -15,6 +15,13 @@
|
||||||
|
<xsl:param name="html.syntax.highlight" select="true()"/>
|
||||||
|
<xsl:param name="html.js.root" select="'file://@XSL_JSDIR@/'"/>
|
||||||
|
|
||||||
|
+<xsl:param name="html.csp.nonce" select="yelp:generate_nonce()"/>
|
||||||
|
+
|
||||||
|
+<xsl:template name="html.head.top.custom">
|
||||||
|
+ <xsl:param name="node" select="."/>
|
||||||
|
+ <meta http-equiv="Content-Security-Policy" content="default-src bogus-ghelp: bogus-gnome-help: bogus-help: bogus-help-list: bogus-info: bogus-man: ; script-src 'nonce-{$html.csp.nonce}'; style-src 'unsafe-inline'; "/>
|
||||||
|
+</xsl:template>
|
||||||
|
+
|
||||||
|
<xsl:template name="html.js.mathjax">
|
||||||
|
<xsl:param name="node" select="."/>
|
||||||
|
<xsl:if test="$node//mml:*[1]">
|
||||||
|
diff --git a/libyelp/yelp-transform.c b/libyelp/yelp-transform.c
|
||||||
|
index e74eb463..2ce1d05b 100644
|
||||||
|
--- a/libyelp/yelp-transform.c
|
||||||
|
+++ b/libyelp/yelp-transform.c
|
||||||
|
@@ -71,6 +71,8 @@ static void xslt_yelp_cache (xsltTransformContextPtr ctxt,
|
||||||
|
xsltStylePreCompPtr comp);
|
||||||
|
static void xslt_yelp_aux (xmlXPathParserContextPtr ctxt,
|
||||||
|
int nargs);
|
||||||
|
+static void xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt,
|
||||||
|
+ int nargs);
|
||||||
|
|
||||||
|
enum {
|
||||||
|
PROP_0,
|
||||||
|
@@ -412,6 +414,10 @@ transform_run (YelpTransform *transform)
|
||||||
|
BAD_CAST "input",
|
||||||
|
BAD_CAST YELP_NAMESPACE,
|
||||||
|
(xmlXPathFunction) xslt_yelp_aux);
|
||||||
|
+ xsltRegisterExtFunction (priv->context,
|
||||||
|
+ BAD_CAST "generate_nonce",
|
||||||
|
+ BAD_CAST YELP_NAMESPACE,
|
||||||
|
+ (xmlXPathFunction) xslt_yelp_generate_nonce);
|
||||||
|
|
||||||
|
priv->output = xsltApplyStylesheetUser (priv->stylesheet,
|
||||||
|
priv->input,
|
||||||
|
@@ -607,3 +613,16 @@ xslt_yelp_aux (xmlXPathParserContextPtr ctxt, int nargs)
|
||||||
|
xsltExtensionInstructionResultRegister (tctxt, ret);
|
||||||
|
valuePush (ctxt, ret);
|
||||||
|
}
|
||||||
|
+
|
||||||
|
+static void
|
||||||
|
+xslt_yelp_generate_nonce (xmlXPathParserContextPtr ctxt, int nargs)
|
||||||
|
+{
|
||||||
|
+ GRand* rand;
|
||||||
|
+ gchar* nonce_str;
|
||||||
|
+
|
||||||
|
+ rand = g_rand_new ();
|
||||||
|
+ nonce_str = g_strdup_printf("%08x%08x", g_rand_int (rand), g_rand_int (rand));
|
||||||
|
+ xmlXPathReturnString (ctxt, xmlStrdup ((xmlChar *) nonce_str));
|
||||||
|
+ g_free(nonce_str);
|
||||||
|
+ g_rand_free(rand);
|
||||||
|
+}
|
||||||
|
diff --git a/libyelp/yelp-view.c b/libyelp/yelp-view.c
|
||||||
|
index 32ae131e..d544c5df 100644
|
||||||
|
--- a/libyelp/yelp-view.c
|
||||||
|
+++ b/libyelp/yelp-view.c
|
||||||
|
@@ -971,7 +971,7 @@ view_external_uri (YelpView *view,
|
||||||
|
|
||||||
|
if (app_info)
|
||||||
|
{
|
||||||
|
- if (!strstr (g_app_info_get_executable (app_info), "yelp"))
|
||||||
|
+ if (!strstr (g_app_info_get_executable (app_info), "yelp") && !strstr (struri, "%3C") && !strstr (struri, "%3E"))
|
||||||
|
{
|
||||||
|
GList l;
|
||||||
|
|
||||||
|
--
|
||||||
|
GitLab
|
||||||
|
|
||||||
@ -3,7 +3,7 @@
|
|||||||
Name: yelp
|
Name: yelp
|
||||||
Epoch: 2
|
Epoch: 2
|
||||||
Version: 40.3
|
Version: 40.3
|
||||||
Release: 2%{?dist}
|
Release: 3%{?dist}
|
||||||
Summary: Help browser for the GNOME desktop
|
Summary: Help browser for the GNOME desktop
|
||||||
|
|
||||||
License: LGPLv2+ and ASL 2.0 and GPLv2+
|
License: LGPLv2+ and ASL 2.0 and GPLv2+
|
||||||
@ -12,6 +12,8 @@ Source: https://download.gnome.org/sources/%{name}/40/%{name}-%{tarball_v
|
|||||||
|
|
||||||
# https://bugzilla.gnome.org/show_bug.cgi?id=687960
|
# https://bugzilla.gnome.org/show_bug.cgi?id=687960
|
||||||
Patch1: 0001-Center-new-windows.patch
|
Patch1: 0001-Center-new-windows.patch
|
||||||
|
# https://issues.redhat.com/browse/RHEL-85927
|
||||||
|
Patch2: yelp-CVE-2025-3155.patch
|
||||||
|
|
||||||
BuildRequires: gcc
|
BuildRequires: gcc
|
||||||
BuildRequires: make
|
BuildRequires: make
|
||||||
@ -93,6 +95,9 @@ desktop-file-validate $RPM_BUILD_ROOT%{_datadir}/applications/yelp.desktop
|
|||||||
|
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Apr 23 2025 David King <dking@redhat.com> - 2:40.3-3
|
||||||
|
- Fix CVE-2025-3155 (RHEL-85927)
|
||||||
|
|
||||||
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 2:40.3-2
|
* Tue Aug 10 2021 Mohan Boddu <mboddu@redhat.com> - 2:40.3-2
|
||||||
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
|
||||||
Related: rhbz#1991688
|
Related: rhbz#1991688
|
||||||
|
|||||||
Loading…
Reference in New Issue
Block a user