From fc637fb28da700da71ec2064d65ca5a7a31b9c6c Mon Sep 17 00:00:00 2001 From: V3n3RiX Date: Sun, 18 Aug 2019 18:16:17 +0100 Subject: gentoo resync : 18.08.2019 --- kde-frameworks/kconfig/Manifest | 5 +- .../files/kconfig-5.60.0-CVE-2019-14744.patch | 147 +++++++++++++++++++++ kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild | 38 ++++++ kde-frameworks/kconfig/kconfig-5.60.0.ebuild | 36 ----- kde-frameworks/kconfig/kconfig-5.61.0.ebuild | 36 +++++ 5 files changed, 225 insertions(+), 37 deletions(-) create mode 100644 kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch create mode 100644 kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild delete mode 100644 kde-frameworks/kconfig/kconfig-5.60.0.ebuild create mode 100644 kde-frameworks/kconfig/kconfig-5.61.0.ebuild (limited to 'kde-frameworks/kconfig') diff --git a/kde-frameworks/kconfig/Manifest b/kde-frameworks/kconfig/Manifest index 02a1867a1641..9a52ddddfda3 100644 --- a/kde-frameworks/kconfig/Manifest +++ b/kde-frameworks/kconfig/Manifest @@ -1,3 +1,6 @@ +AUX kconfig-5.60.0-CVE-2019-14744.patch 5346 BLAKE2B e835fe15bacf697a50d991bb1451d2538f6a44cbf863084d979f1fe2a6c4f72284d5ddd75925240784d3868580afdc03046674c63e76ae57cde009c76bd81b60 SHA512 0265a6e02e1ac6a7bb30e75eb169c83a69237e2dd2f80a4be18b47ecd758aa27dbcecc45d2e18a52df049b32313dfd5b5432bfcfa39611279194d2c9b48dc35e DIST kconfig-5.60.0.tar.xz 240404 BLAKE2B 92855462c8be4b95adcd87100bceb68975f2f5f5f943c7f5cc91b2c7bf14e43227f7c572663a7ad7fac3a993a2a3bcd77d11ad0a8abb24c2fe68f07ad61e1d17 SHA512 76aa15e9e1630c687ff7cc6b77060c74472f307442d07ae09d5f4aa61d7b6f29f3f1d270218c6d7fea8e86eb9dda43c96821d19d827a781c7f71da6135d98753 -EBUILD kconfig-5.60.0.ebuild 661 BLAKE2B b18b407a4f7ccc10a035ba37279c070fcecdc1aac9094cedbfb04577b1dcd309e6c90b27542c986131774728afd55881be90a2a75e043449ee3bca0f98636b6f SHA512 6e8bef88548cec26c65797c979a854b167c63b8667a077c0c7bb0cd6449679cfc90c0136272087e4ec28a629f823c3522eeea5d82f879f94b21f4ea5f9067813 +DIST kconfig-5.61.0.tar.xz 240508 BLAKE2B 01505ac88c1240a04b96cbff08425b9eda93b94d0d3679c2c2906ce26468eb1d88f7d49de997c99e502b5e14812731ee74405bd8baf290cafcc2afb1a9c4806e SHA512 38a1e9d4cfc1ca692b9721c56536cb8f19cbd3b75ec9ccb400c811dddcefe78f5147d6fccc99a4202aa78ab9d1a68028312c7202103397164983bd02f59fd705 +EBUILD kconfig-5.60.0-r1.ebuild 713 BLAKE2B c85b007da49c9b982ef2a000b81a04e11aee5aa5c963b7c41179d9dc7ef077038e34fd6383a50ca612631b40e5e3bc181f982f9dcd3f6f6ab5bd0b6737873866 SHA512 fd7329e41ffda88dfc3b0b3800a4dcd6540e2ec9d262fef35ecbfd617035c500ccfa8608ee66c5e4b7679ebdb2326fefb5c1c6e2ff989259b7cdf9221050c15d +EBUILD kconfig-5.61.0.ebuild 664 BLAKE2B b3aa3333ce71a50b51cf46e5a4c4ad148d26f518f1ce8f540c7d4f595e6d09d400f3f683d26610b4b9f9b4cb1f8beb04f3c46faaf27958cd08e709d33e4fe393 SHA512 ca684681b6f6681ee3134076ac12fe6bee0cdad2ea37df395351a9e1cc0be64ec8b13695251ab54652b57813881fbf09f2f5bc54c68b5f9d7a71c537eb1610eb MISC metadata.xml 249 BLAKE2B ad415db89e5dee1627aa77f44ded9d4e1e5b8217d06c7ca25bbaa3fe92ce67c2b1090957c45a821b407d7927e5af798498aa6a5b903895ee1af8ee20a446c7f7 SHA512 76a5a340b13f0053ca3c5e94ed24380ea8d29b45ac8655419e22eaadb1e4a827c04d2e7e36b65145c4964e6526f656618fc6ac144e277ef53cb7373e6239e3c3 diff --git a/kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch b/kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch new file mode 100644 index 000000000000..e8a799ca5d2d --- /dev/null +++ b/kde-frameworks/kconfig/files/kconfig-5.60.0-CVE-2019-14744.patch @@ -0,0 +1,147 @@ +From 5d3e71b1d2ecd2cb2f910036e614ffdfc895aa22 Mon Sep 17 00:00:00 2001 +From: David Faure +Date: Wed, 7 Aug 2019 09:35:36 +0200 +Subject: Security: remove support for $(...) in config keys with [$e] marker. + +Summary: +It is very unclear at this point what a valid use case for this feature +would possibly be. The old documentation only mentions $(hostname) as +an example, which can be done with $HOSTNAME instead. + +Note that $(...) is still supported in Exec lines of desktop files, +this does not require [$e] anyway (and actually works better without it, +otherwise the $ signs need to be doubled to obey kconfig $e escaping rules...). + +Test Plan: +ctest passes; various testcases with $(...) in desktop files, +directory files, and config files, no longer execute commands. + +Reviewers: mdawson, aacid, broulik, davidedmundson, kossebau, apol, sitter, security-team + +Reviewed By: mdawson, davidedmundson + +Subscribers: ZaWertun, rikmills, fvogt, ngraham, kde-frameworks-devel + +Tags: #frameworks + +Differential Revision: https://phabricator.kde.org/D22979 +--- + autotests/kconfigtest.cpp | 10 ++-------- + docs/options.md | 11 ++++------- + src/core/kconfig.cpp | 37 +------------------------------------ + 3 files changed, 7 insertions(+), 51 deletions(-) + +diff --git a/autotests/kconfigtest.cpp b/autotests/kconfigtest.cpp +index 410b5b8..9af3b46 100644 +--- a/autotests/kconfigtest.cpp ++++ b/autotests/kconfigtest.cpp +@@ -38,7 +38,7 @@ + #include + #endif + #ifndef Q_OS_WIN +-#include // gethostname ++#include // getuid + #endif + + KCONFIGGROUP_DECLARE_ENUM_QOBJECT(KConfigTest, Testing) +@@ -546,14 +546,8 @@ void KConfigTest::testPath() + QCOMPARE(group.readPathEntry("withBraces", QString()), QString("file://" + HOMEPATH)); + QVERIFY(group.hasKey("URL")); + QCOMPARE(group.readEntry("URL", QString()), QString("file://" + HOMEPATH)); +-#if !defined(Q_OS_WIN32) && !defined(Q_OS_MAC) +- // I don't know if this will work on windows +- // This test hangs on OS X + QVERIFY(group.hasKey("hostname")); +- char hostname[256]; +- QVERIFY(::gethostname(hostname, sizeof(hostname)) == 0); +- QCOMPARE(group.readEntry("hostname", QString()), QString::fromLatin1(hostname)); +-#endif ++ QCOMPARE(group.readEntry("hostname", QString()), QStringLiteral("(hostname)")); // the $ got removed because empty var name + QVERIFY(group.hasKey("noeol")); + QCOMPARE(group.readEntry("noeol", QString()), QString("foo")); + +diff --git a/docs/options.md b/docs/options.md +index c634c00..4a6e9bc 100644 +--- a/docs/options.md ++++ b/docs/options.md +@@ -67,18 +67,15 @@ environment variables (and `XDG_CONFIG_HOME` in particular). + Shell Expansion + --------------- + +-If an entry is marked with `$e`, environment variables and shell commands will +-be expanded. ++If an entry is marked with `$e`, environment variables will be expanded. + + Name[$e]=$USER +- Host[$e]=$(hostname) + + When the "Name" entry is read `$USER` will be replaced with the value of the +-`$USER` environment variable, and `$(hostname)` will be replaced with the output +-of the `hostname` command. ++`$USER` environment variable. + +-Note that the application will replace `$USER` and `$(hostname)` with their +-respective expanded values after saving. To prevent this combine the `$e` option ++Note that the application will replace `$USER` with its ++expanded value after saving. To prevent this combine the `$e` option + with `$i` (immmutable) option. For example: + + Name[$ei]=$USER +diff --git a/src/core/kconfig.cpp b/src/core/kconfig.cpp +index e1b11ed..f6824ce 100644 +--- a/src/core/kconfig.cpp ++++ b/src/core/kconfig.cpp +@@ -28,19 +28,6 @@ + #include + #include + +-#ifdef _MSC_VER +-static inline FILE *popen(const char *cmd, const char *mode) +-{ +- return _popen(cmd, mode); +-} +-static inline int pclose(FILE *stream) +-{ +- return _pclose(stream); +-} +-#else +-#include +-#endif +- + #include "kconfigbackend_p.h" + #include "kconfiggroup.h" + +@@ -183,29 +170,7 @@ QString KConfigPrivate::expandString(const QString &value) + int nDollarPos = aValue.indexOf(QLatin1Char('$')); + while (nDollarPos != -1 && nDollarPos + 1 < aValue.length()) { + // there is at least one $ +- if (aValue[nDollarPos + 1] == QLatin1Char('(')) { +- int nEndPos = nDollarPos + 1; +- // the next character is not $ +- while ((nEndPos <= aValue.length()) && (aValue[nEndPos] != QLatin1Char(')'))) { +- nEndPos++; +- } +- nEndPos++; +- QString cmd = aValue.mid(nDollarPos + 2, nEndPos - nDollarPos - 3); +- +- QString result; +- +-// FIXME: wince does not have pipes +-#ifndef _WIN32_WCE +- FILE *fs = popen(QFile::encodeName(cmd).data(), "r"); +- if (fs) { +- QTextStream ts(fs, QIODevice::ReadOnly); +- result = ts.readAll().trimmed(); +- pclose(fs); +- } +-#endif +- aValue.replace(nDollarPos, nEndPos - nDollarPos, result); +- nDollarPos += result.length(); +- } else if (aValue[nDollarPos + 1] != QLatin1Char('$')) { ++ if (aValue[nDollarPos + 1] != QLatin1Char('$')) { + int nEndPos = nDollarPos + 1; + // the next character is not $ + QStringRef aVarName; +-- +cgit v1.1 + diff --git a/kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild b/kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild new file mode 100644 index 000000000000..051742601b42 --- /dev/null +++ b/kde-frameworks/kconfig/kconfig-5.60.0-r1.ebuild @@ -0,0 +1,38 @@ +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +VIRTUALX_REQUIRED="test" +inherit kde5 + +DESCRIPTION="Framework for reading and writing configuration" +LICENSE="LGPL-2+" +KEYWORDS="amd64 ~arm arm64 x86" +IUSE="dbus nls" + +BDEPEND=" + nls? ( $(add_qt_dep linguist-tools) ) +" +RDEPEND=" + $(add_qt_dep qtgui) + $(add_qt_dep qtxml) + dbus? ( $(add_qt_dep qtdbus) ) +" +DEPEND="${RDEPEND} + test? ( $(add_qt_dep qtconcurrent) ) +" + +# bug 560086 +RESTRICT+=" test" + +DOCS=( DESIGN docs/DESIGN.kconfig docs/options.md ) + +PATCHES=( "${FILESDIR}/${P}-CVE-2019-14744.patch") + +src_configure() { + local mycmakeargs=( + -DKCONFIG_USE_DBUS=$(usex dbus) + ) + kde5_src_configure +} diff --git a/kde-frameworks/kconfig/kconfig-5.60.0.ebuild b/kde-frameworks/kconfig/kconfig-5.60.0.ebuild deleted file mode 100644 index 113d69543507..000000000000 --- a/kde-frameworks/kconfig/kconfig-5.60.0.ebuild +++ /dev/null @@ -1,36 +0,0 @@ -# Copyright 1999-2019 Gentoo Authors -# Distributed under the terms of the GNU General Public License v2 - -EAPI=7 - -VIRTUALX_REQUIRED="test" -inherit kde5 - -DESCRIPTION="Framework for reading and writing configuration" -LICENSE="LGPL-2+" -KEYWORDS="amd64 ~arm arm64 x86" -IUSE="dbus nls" - -BDEPEND=" - nls? ( $(add_qt_dep linguist-tools) ) -" -RDEPEND=" - $(add_qt_dep qtgui) - $(add_qt_dep qtxml) - dbus? ( $(add_qt_dep qtdbus) ) -" -DEPEND="${RDEPEND} - test? ( $(add_qt_dep qtconcurrent) ) -" - -# bug 560086 -RESTRICT+=" test" - -DOCS=( DESIGN docs/DESIGN.kconfig docs/options.md ) - -src_configure() { - local mycmakeargs=( - -DKCONFIG_USE_DBUS=$(usex dbus) - ) - kde5_src_configure -} diff --git a/kde-frameworks/kconfig/kconfig-5.61.0.ebuild b/kde-frameworks/kconfig/kconfig-5.61.0.ebuild new file mode 100644 index 000000000000..f53a08c98dd8 --- /dev/null +++ b/kde-frameworks/kconfig/kconfig-5.61.0.ebuild @@ -0,0 +1,36 @@ +# Copyright 1999-2019 Gentoo Authors +# Distributed under the terms of the GNU General Public License v2 + +EAPI=7 + +VIRTUALX_REQUIRED="test" +inherit kde5 + +DESCRIPTION="Framework for reading and writing configuration" +LICENSE="LGPL-2+" +KEYWORDS="~amd64 ~arm ~arm64 ~x86" +IUSE="dbus nls" + +BDEPEND=" + nls? ( $(add_qt_dep linguist-tools) ) +" +RDEPEND=" + $(add_qt_dep qtgui) + $(add_qt_dep qtxml) + dbus? ( $(add_qt_dep qtdbus) ) +" +DEPEND="${RDEPEND} + test? ( $(add_qt_dep qtconcurrent) ) +" + +# bug 560086 +RESTRICT+=" test" + +DOCS=( DESIGN docs/DESIGN.kconfig docs/options.md ) + +src_configure() { + local mycmakeargs=( + -DKCONFIG_USE_DBUS=$(usex dbus) + ) + kde5_src_configure +} -- cgit v1.2.3