From acad49edefd0e0f7b5cb5272806875749441a303 Mon Sep 17 00:00:00 2001 From: Michael Palimaka Date: Wed, 2 Nov 2016 23:04:57 +1100 Subject: kde-apps/kdepimlibs: backport additional commits from upstream to resolve CVE-2016-7966 Gentoo-bug: 596224 Package-Manager: portage-2.3.2 --- .../files/kdepimlibs-CVE-2016-7966-r1.patch | 135 +++++++++++++++++++++ kde-apps/kdepimlibs/kdepimlibs-4.14.10-r2.ebuild | 62 ++++++++++ .../kdepimlibs-4.14.11_pre20160211-r2.ebuild | 66 ++++++++++ 3 files changed, 263 insertions(+) create mode 100644 kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966-r1.patch create mode 100644 kde-apps/kdepimlibs/kdepimlibs-4.14.10-r2.ebuild create mode 100644 kde-apps/kdepimlibs/kdepimlibs-4.14.11_pre20160211-r2.ebuild (limited to 'kde-apps') diff --git a/kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966-r1.patch b/kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966-r1.patch new file mode 100644 index 000000000000..9bea5726d037 --- /dev/null +++ b/kde-apps/kdepimlibs/files/kdepimlibs-CVE-2016-7966-r1.patch @@ -0,0 +1,135 @@ +From 176fee25ca79145ab5c8e2275d248f1a46a8d8cf Mon Sep 17 00:00:00 2001 +From: Montel Laurent +Date: Fri, 30 Sep 2016 15:55:35 +0200 +Subject: [PATCH] Backport avoid to transform as a url when we have a quote + +--- + kpimutils/linklocator.cpp | 30 +++++++++++++++++++++++++++--- + kpimutils/linklocator.h | 3 ++- + 2 files changed, 29 insertions(+), 4 deletions(-) + +diff --git a/kpimutils/linklocator.cpp b/kpimutils/linklocator.cpp +index f5d9afd..f30e8fc 100644 +--- a/kpimutils/linklocator.cpp ++++ b/kpimutils/linklocator.cpp +@@ -95,6 +95,12 @@ int LinkLocator::maxAddressLen() const + + QString LinkLocator::getUrl() + { ++ return getUrlAndCheckValidHref(); ++} ++ ++ ++QString LinkLocator::getUrlAndCheckValidHref(bool *badurl) ++{ + QString url; + if ( atUrl() ) { + // NOTE: see http://tools.ietf.org/html/rfc3986#appendix-A and especially appendix-C +@@ -129,13 +135,26 @@ QString LinkLocator::getUrl() + + url.reserve( maxUrlLen() ); // avoid allocs + int start = mPos; ++ bool previousCharIsADoubleQuote = false; + while ( ( mPos < (int)mText.length() ) && + ( mText[mPos].isPrint() || mText[mPos].isSpace() ) && + ( ( afterUrl.isNull() && !mText[mPos].isSpace() ) || + ( !afterUrl.isNull() && mText[mPos] != afterUrl ) ) ) { + if ( !mText[mPos].isSpace() ) { // skip whitespace +- url.append( mText[mPos] ); +- if ( url.length() > maxUrlLen() ) { ++ if (mText[mPos] == QLatin1Char('>') && previousCharIsADoubleQuote) { ++ //it's an invalid url ++ if (badurl) { ++ *badurl = true; ++ } ++ return QString(); ++ } ++ if (mText[mPos] == QLatin1Char('"')) { ++ previousCharIsADoubleQuote = true; ++ } else { ++ previousCharIsADoubleQuote = false; ++ } ++ url.append( mText[mPos] ); ++ if ( url.length() > maxUrlLen() ) { + break; + } + } +@@ -367,7 +386,12 @@ QString LinkLocator::convertToHtml( const QString &plainText, int flags, + } else { + const int start = locator.mPos; + if ( !( flags & IgnoreUrls ) ) { +- str = locator.getUrl(); ++ bool badUrl = false; ++ str = locator.getUrlAndCheckValidHref(&badUrl); ++ if (badUrl) { ++ return locator.mText; ++ } ++ + if ( !str.isEmpty() ) { + QString hyperlink; + if ( str.left( 4 ) == QLatin1String("www.") ) { +diff --git a/kpimutils/linklocator.h b/kpimutils/linklocator.h +index 3049397..375498d 100644 +--- a/kpimutils/linklocator.h ++++ b/kpimutils/linklocator.h +@@ -107,6 +107,7 @@ class KPIMUTILS_EXPORT LinkLocator + @return The URL at the current scan position, or an empty string. + */ + QString getUrl(); ++ QString getUrlAndCheckValidHref(bool *badurl = 0); + + /** + Attempts to grab an email address. If there is an @ symbol at the +@@ -155,7 +156,7 @@ class KPIMUTILS_EXPORT LinkLocator + */ + static QString pngToDataUrl( const QString & iconPath ); + +- protected: ++protected: + /** + The plaintext string being scanned for URLs and email addresses. + */ +-- +2.7.3 + +From 8bbe1bd3fdc55f609340edc667ff154b3d2aaab1 Mon Sep 17 00:00:00 2001 +From: Montel Laurent +Date: Tue, 11 Oct 2016 11:47:41 +0200 +Subject: [PATCH] Backport show bad url text + +--- + kpimutils/linklocator.cpp | 18 +++++++++++++++++- + 1 file changed, 17 insertions(+), 1 deletion(-) + +diff --git a/kpimutils/linklocator.cpp b/kpimutils/linklocator.cpp +index f30e8fc..4abe968 100644 +--- a/kpimutils/linklocator.cpp ++++ b/kpimutils/linklocator.cpp +@@ -389,7 +389,23 @@ QString LinkLocator::convertToHtml( const QString &plainText, int flags, + bool badUrl = false; + str = locator.getUrlAndCheckValidHref(&badUrl); + if (badUrl) { +- return locator.mText; ++ QString resultBadUrl; ++ const int helperTextSize(locator.mText.count()); ++ for (int i = 0; i < helperTextSize; ++i) { ++ const QChar chBadUrl = locator.mText[i]; ++ if (chBadUrl == QLatin1Char('&')) { ++ resultBadUrl += QLatin1String("&"); ++ } else if (chBadUrl == QLatin1Char('"')) { ++ resultBadUrl += QLatin1String("""); ++ } else if (chBadUrl == QLatin1Char('<')) { ++ resultBadUrl += QLatin1String("<"); ++ } else if (chBadUrl == QLatin1Char('>')) { ++ resultBadUrl += QLatin1String(">"); ++ } else { ++ resultBadUrl += chBadUrl; ++ } ++ } ++ return resultBadUrl; + } + + if ( !str.isEmpty() ) { +-- +2.7.3 + diff --git a/kde-apps/kdepimlibs/kdepimlibs-4.14.10-r2.ebuild b/kde-apps/kdepimlibs/kdepimlibs-4.14.10-r2.ebuild new file mode 100644 index 000000000000..b9355e7c55e1 --- /dev/null +++ b/kde-apps/kdepimlibs/kdepimlibs-4.14.10-r2.ebuild @@ -0,0 +1,62 @@ +# Copyright 1999-2016 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Id$ + +EAPI=6 + +KDE_HANDBOOK="optional" +CPPUNIT_REQUIRED="optional" +EGIT_BRANCH="KDE/4.14" +inherit kde4-base + +DESCRIPTION="Common library for KDE PIM apps" +KEYWORDS="~amd64 ~arm ~x86 ~amd64-linux ~x86-linux" +LICENSE="LGPL-2.1" +IUSE="debug ldap prison" + +# some akonadi tests timeout, that probaly needs more work as its ~700 tests +RESTRICT="test" + +DEPEND=" + >=app-crypt/gpgme-1.1.6 + >=dev-libs/boost-1.35.0-r5:= + dev-libs/libgpg-error + >=dev-libs/libical-0.48-r2:= + dev-libs/cyrus-sasl + >=dev-libs/qjson-0.8.1 + kde-apps/akonadi:4 + media-libs/phonon[qt4] + x11-misc/shared-mime-info + prison? ( media-libs/prison:4 ) + ldap? ( net-nds/openldap ) +" +# boost is not linked to, but headers which include it are installed +# bug #418071 +RDEPEND="${DEPEND} + !=kde-apps/kdepim-runtime-4.10* + !=kde-apps/kdepim-runtime-4.11* + !