From: Caleb Tennis Date: Fri, 30 Mar 2007 12:56:29 +0000 (+0000) Subject: Adding a XSS fix patch from kde-packager X-Git-Url: http://git.tremily.us/?a=commitdiff_plain;h=e460dea1ab9f6220eeae0bd999410bdb73337590;p=gentoo.git Adding a XSS fix patch from kde-packager Package-Manager: portage-2.1.2.2 --- diff --git a/kde-base/kdelibs/ChangeLog b/kde-base/kdelibs/ChangeLog index c119d47e955d..0249921a1830 100644 --- a/kde-base/kdelibs/ChangeLog +++ b/kde-base/kdelibs/ChangeLog @@ -1,6 +1,12 @@ # ChangeLog for kde-base/kdelibs # Copyright 2002-2007 Gentoo Foundation; Distributed under the GPL v2 -# $Header: /var/cvsroot/gentoo-x86/kde-base/kdelibs/ChangeLog,v 1.438 2007/03/22 15:53:35 wolf31o2 Exp $ +# $Header: /var/cvsroot/gentoo-x86/kde-base/kdelibs/ChangeLog,v 1.439 2007/03/30 12:56:29 caleb Exp $ + +*kdelibs-3.5.6-r4 (30 Mar 2007) + + 30 Mar 2007; Caleb Tennis + +files/kdelibs-3.5.6-kjs-xss.diff, +kdelibs-3.5.6-r4.ebuild: + Adding a XSS fix patch from kde-packager 22 Mar 2007; Chris Gianelloni kdelibs-3.5.5-r9.ebuild: diff --git a/kde-base/kdelibs/Manifest b/kde-base/kdelibs/Manifest index 3b9d4411fa1c..3d0bb5352455 100644 --- a/kde-base/kdelibs/Manifest +++ b/kde-base/kdelibs/Manifest @@ -1,6 +1,3 @@ ------BEGIN PGP SIGNED MESSAGE----- -Hash: SHA1 - AUX kdelibs-3.5.5-CVE-2007-0537.patch 1232 RMD160 a15192ccbbb27c323de2188b2a5a945c253b53ac SHA1 4c7f05af310bda28f97117e72b08ebb18a36252b SHA256 f83289c67c66de5d6afe78d1149d2f28514d0ce26841c36a67efdd1d2f7f451d MD5 287cfc385b261e687aa32908033d2112 files/kdelibs-3.5.5-CVE-2007-0537.patch 1232 RMD160 a15192ccbbb27c323de2188b2a5a945c253b53ac files/kdelibs-3.5.5-CVE-2007-0537.patch 1232 @@ -33,6 +30,10 @@ AUX kdelibs-3.5.6-khtml-kde-bug-140768.patch 1211 RMD160 5215d567765b871dd06af23 MD5 eb13fecb46d703561ff3b7518876042c files/kdelibs-3.5.6-khtml-kde-bug-140768.patch 1211 RMD160 5215d567765b871dd06af23cce293860fd8c2446 files/kdelibs-3.5.6-khtml-kde-bug-140768.patch 1211 SHA256 cf4033eccf1bd85ca6a32e8c894d418e743c02f35f30030e23dd9d4aef85cd22 files/kdelibs-3.5.6-khtml-kde-bug-140768.patch 1211 +AUX kdelibs-3.5.6-kjs-xss.diff 1339 RMD160 8dc78056fadc29ac324eb6daec27cf06a3f33a64 SHA1 37d9b04ece1b72c6e4bc44ccefc0a63b9fb518a4 SHA256 124ba2baf644585a7f348e232ff7f7b13949b5948bf7ce3cc6f3af220d3776e8 +MD5 a54d2a43e3dfca929a0911c73d9f8de6 files/kdelibs-3.5.6-kjs-xss.diff 1339 +RMD160 8dc78056fadc29ac324eb6daec27cf06a3f33a64 files/kdelibs-3.5.6-kjs-xss.diff 1339 +SHA256 124ba2baf644585a7f348e232ff7f7b13949b5948bf7ce3cc6f3af220d3776e8 files/kdelibs-3.5.6-kjs-xss.diff 1339 DIST kdelibs-3.5-patchset-05.tar.bz2 36423 RMD160 684bb235f3b5b3cb900632e11aa912670f641b96 SHA1 138232cf05ab131a51f3b3febfdd8a3cbc42d45f SHA256 f237ccd3a35c629740355fbcf69b0d706690acac832a4d35db5c0d3a30235e0a DIST kdelibs-3.5.5-seli-xinerama.patch.bz2 5470 RMD160 46ed378f1ff2f7e2fa113aa0bf51eae1758264f9 SHA1 1f1e7a02e0dfc35fd2d27d8983a16e53e42397c0 SHA256 8d002a55954aabdb91a534a1b1f1f37c706faebbae0398fb5a2ff29eeb66954c DIST kdelibs-3.5.5.tar.bz2 15486690 RMD160 8e389869f9a53445754c76a0f7535ef2fffc6d03 SHA1 7961818e41e22cce7c58219c4eb63ed5fbb94307 SHA256 e487cdd56aa14eec3e100501a5e14658c6329fac30ea0ce812c860e3564c31e3 @@ -69,10 +70,14 @@ EBUILD kdelibs-3.5.6-r3.ebuild 6056 RMD160 a4e776176cdbb57bc1353ddc40969fc7caf89 MD5 0a14150255d5a6c53b74389d6aafc3e5 kdelibs-3.5.6-r3.ebuild 6056 RMD160 a4e776176cdbb57bc1353ddc40969fc7caf89c32 kdelibs-3.5.6-r3.ebuild 6056 SHA256 dc7e9cff61e2be92b4e9334b9d4e0f2fa0c980d54009b9f4b9b57fbd9746a9bf kdelibs-3.5.6-r3.ebuild 6056 -MISC ChangeLog 71116 RMD160 33b2cba8149b9155935a3f04b21b03a0750733ee SHA1 27bbccb0fa7446e6c35baaab762b6e26fae5a6dc SHA256 81d62cd40c750f9f5e76d866acd89945bcda9f3de810343c639db192bea854d0 -MD5 451c285297c047914cf405a19ae7bdea ChangeLog 71116 -RMD160 33b2cba8149b9155935a3f04b21b03a0750733ee ChangeLog 71116 -SHA256 81d62cd40c750f9f5e76d866acd89945bcda9f3de810343c639db192bea854d0 ChangeLog 71116 +EBUILD kdelibs-3.5.6-r4.ebuild 6095 RMD160 99e40946bb1b1f4f97418c009315ed6699697f42 SHA1 6325b24d81a511b8564ec407f3fb00eb2bdbe3e1 SHA256 7a5d657746e6e0786edfe4370662c1271bd1c71b884413c0aeab6a3af474e616 +MD5 95410947a63ed7933013dc1a3b52b8ed kdelibs-3.5.6-r4.ebuild 6095 +RMD160 99e40946bb1b1f4f97418c009315ed6699697f42 kdelibs-3.5.6-r4.ebuild 6095 +SHA256 7a5d657746e6e0786edfe4370662c1271bd1c71b884413c0aeab6a3af474e616 kdelibs-3.5.6-r4.ebuild 6095 +MISC ChangeLog 71300 RMD160 a3ee22c550ded19a4c6d5c91b8ae1d918d678953 SHA1 bf0d10a59a67dc102f1d188f8ba6d2db111af38d SHA256 6998e0ec9df5d6bc82c64778740eed7eebcd429f5e78b14dc9b438783915adf5 +MD5 3f952bf77b61194c0be08fa95a9d7f36 ChangeLog 71300 +RMD160 a3ee22c550ded19a4c6d5c91b8ae1d918d678953 ChangeLog 71300 +SHA256 6998e0ec9df5d6bc82c64778740eed7eebcd429f5e78b14dc9b438783915adf5 ChangeLog 71300 MISC metadata.xml 156 RMD160 ecce3b981f150c45ae1e84e2d208e678d6124259 SHA1 b64f7c0b4e5db816d82ad19848f72118af129d35 SHA256 2f4da28506b9d4185f320f67a6191d30c7a921217ed4447ed46ea0bc4aefc79a MD5 acc03a4b12bb0433a57e95bd253b9501 metadata.xml 156 RMD160 ecce3b981f150c45ae1e84e2d208e678d6124259 metadata.xml 156 @@ -101,10 +106,6 @@ SHA256 d5b5e2137db88c1c903fdff689b4dd29929f9e1e8b4336fb64fb0e82094d5d88 files/di MD5 b82df77d8d947cfd51e3fad1ce093674 files/digest-kdelibs-3.5.6-r3 807 RMD160 e5e25e17340fbe888f9c28829d332c34148d1f06 files/digest-kdelibs-3.5.6-r3 807 SHA256 d5b5e2137db88c1c903fdff689b4dd29929f9e1e8b4336fb64fb0e82094d5d88 files/digest-kdelibs-3.5.6-r3 807 ------BEGIN PGP SIGNATURE----- -Version: GnuPG v2.0.3 (GNU/Linux) - -iD8DBQFGAqaFkT4lNIS36YERAiPPAJ9hg+h3/WcSbb5oiv8S6kBkprBOYgCeKijF -J8C3U44XLOJbwiC/twVtQ1Y= -=w4HY ------END PGP SIGNATURE----- +MD5 b82df77d8d947cfd51e3fad1ce093674 files/digest-kdelibs-3.5.6-r4 807 +RMD160 e5e25e17340fbe888f9c28829d332c34148d1f06 files/digest-kdelibs-3.5.6-r4 807 +SHA256 d5b5e2137db88c1c903fdff689b4dd29929f9e1e8b4336fb64fb0e82094d5d88 files/digest-kdelibs-3.5.6-r4 807 diff --git a/kde-base/kdelibs/files/digest-kdelibs-3.5.6-r4 b/kde-base/kdelibs/files/digest-kdelibs-3.5.6-r4 new file mode 100644 index 000000000000..1585f02345d9 --- /dev/null +++ b/kde-base/kdelibs/files/digest-kdelibs-3.5.6-r4 @@ -0,0 +1,9 @@ +MD5 6f8254317dd43af7aea2a347656f552a kdelibs-3.5-patchset-05.tar.bz2 36423 +RMD160 684bb235f3b5b3cb900632e11aa912670f641b96 kdelibs-3.5-patchset-05.tar.bz2 36423 +SHA256 f237ccd3a35c629740355fbcf69b0d706690acac832a4d35db5c0d3a30235e0a kdelibs-3.5-patchset-05.tar.bz2 36423 +MD5 d8ce997461cb1aa2255032f02fd14326 kdelibs-3.5.5-seli-xinerama.patch.bz2 5470 +RMD160 46ed378f1ff2f7e2fa113aa0bf51eae1758264f9 kdelibs-3.5.5-seli-xinerama.patch.bz2 5470 +SHA256 8d002a55954aabdb91a534a1b1f1f37c706faebbae0398fb5a2ff29eeb66954c kdelibs-3.5.5-seli-xinerama.patch.bz2 5470 +MD5 e4d137879a66e92b895b3de5413a61d8 kdelibs-3.5.6.tar.bz2 15509460 +RMD160 ce8c088e13f0e59238719600da9c768eac58b57d kdelibs-3.5.6.tar.bz2 15509460 +SHA256 06766202c6ae21277b7879f363ed88fde8016586ec8c94deb59be260f2231b5c kdelibs-3.5.6.tar.bz2 15509460 diff --git a/kde-base/kdelibs/files/kdelibs-3.5.6-kjs-xss.diff b/kde-base/kdelibs/files/kdelibs-3.5.6-kjs-xss.diff new file mode 100644 index 000000000000..ca4456320ee9 --- /dev/null +++ b/kde-base/kdelibs/files/kdelibs-3.5.6-kjs-xss.diff @@ -0,0 +1,38 @@ +------------------------------------------------------------------------ +r645387 | porten | 2007-03-22 15:01:13 +0100 (Thu, 22 Mar 2007) | 4 lines + +substitute some of the invalid sequences with the standard replacement +char. this matches Mozilla but not IE which leaves them unchanged (or +throws an exception) + +------------------------------------------------------------------------ +--- kjs/function.cpp ++++ kjs/function.cpp +@@ -244,11 +244,15 @@ UString decodeURI(ExecState *exec, UStri + } + + // UTF-8 transform ++ const unsigned long replacementChar = 0xFFFD; + unsigned long V; + if (n == 2) { + unsigned long yyyyy = octets[0] & 0x1F; + unsigned long zzzzzz = octets[1] & 0x3F; + V = (yyyyy << 6) | zzzzzz; ++ // 2-byte sequence overlong for this value? ++ if (V < 0xFF) ++ V = replacementChar; + C = UChar((unsigned short)V); + } + else if (n == 3) { +@@ -256,6 +260,11 @@ UString decodeURI(ExecState *exec, UStri + unsigned long yyyyyy = octets[1] & 0x3F; + unsigned long zzzzzz = octets[2] & 0x3F; + V = (xxxx << 12) | (yyyyyy << 6) | zzzzzz; ++ // 3-byte sequence overlong for this value, ++ // an invalid value or UTF-16 surrogate? ++ if (V < 0x800 || V == 0xFFFE || V == 0xFFFF || ++ (V >= 0xD800 && V <= 0xDFFF)) ++ V = replacementChar; + C = UChar((unsigned short)V); + } + else { diff --git a/kde-base/kdelibs/kdelibs-3.5.6-r4.ebuild b/kde-base/kdelibs/kdelibs-3.5.6-r4.ebuild new file mode 100644 index 000000000000..4f404bf3b7c4 --- /dev/null +++ b/kde-base/kdelibs/kdelibs-3.5.6-r4.ebuild @@ -0,0 +1,201 @@ +# Copyright 1999-2007 Gentoo Foundation +# Distributed under the terms of the GNU General Public License v2 +# $Header: /var/cvsroot/gentoo-x86/kde-base/kdelibs/kdelibs-3.5.6-r4.ebuild,v 1.1 2007/03/30 12:56:29 caleb Exp $ + +inherit kde flag-o-matic eutils multilib +set-kdedir 3.5 + +DESCRIPTION="KDE libraries needed by all KDE programs." +HOMEPAGE="http://www.kde.org/" +SRC_URI="mirror://kde/stable/${PV}/src/${P}.tar.bz2 + mirror://gentoo/kdelibs-3.5-patchset-05.tar.bz2 + mirror://gentoo/${PN}-3.5.5-seli-xinerama.patch.bz2" + +LICENSE="GPL-2 LGPL-2" +SLOT="3.5" +KEYWORDS="~alpha ~amd64 ~hppa ~ia64 ~ppc ~ppc64 ~sparc ~x86 ~x86-fbsd" +IUSE="acl alsa arts cups doc jpeg2k kerberos legacyssl utempter openexr spell ssl tiff +zeroconf avahi kernel_linux fam lua linguas_he kdehiddenvisibility" + +# kde.eclass has kdelibs in DEPEND, and we can't have that in here. +# so we recreate the entire DEPEND from scratch. + +# Added aspell-en as dependency to work around bug 131512. +RDEPEND="$(qt_min_version 3.3.3) + arts? ( >=kde-base/arts-3.5.5 ) + app-arch/bzip2 + >=media-libs/freetype-2 + media-libs/fontconfig + >=dev-libs/libxslt-1.1.16 + >=dev-libs/libxml2-2.6.6 + >=dev-libs/libpcre-4.2 + media-libs/libart_lgpl + net-dns/libidn + acl? ( kernel_linux? ( sys-apps/acl ) ) + ssl? ( >=dev-libs/openssl-0.9.7d ) + alsa? ( media-libs/alsa-lib ) + cups? ( >=net-print/cups-1.1.19 ) + tiff? ( media-libs/tiff ) + kerberos? ( virtual/krb5 ) + jpeg2k? ( media-libs/jasper ) + openexr? ( >=media-libs/openexr-1.2.2-r2 ) + zeroconf? ( !avahi? ( net-misc/mDNSResponder !kde-misc/kdnssd-avahi ) ) + fam? ( virtual/fam ) + virtual/ghostscript + utempter? ( sys-libs/libutempter ) + !kde-base/kde-env + lua? ( dev-lang/lua ) + spell? ( app-text/aspell app-dicts/aspell-en + linguas_he? ( >=app-text/hspell-1.0 ) )" + +DEPEND="${RDEPEND} + doc? ( app-doc/doxygen ) + sys-devel/gettext" + +RDEPEND="${RDEPEND} + || ( ( x11-apps/rgb x11-apps/iceauth ) lib64 symlink for amd64 2005.0 profile + if [ "${SYMLINK_LIB}" = "yes" ]; then + dosym $(get_abi_LIBDIR ${DEFAULT_ABI}) ${KDEDIR}/lib + fi + + # Get rid of the disabled version of the kdnsd libraries + if use zeroconf && use avahi; then + rm -rf "${D}/${PREFIX}"/$(get_libdir)/libkdnssd.* + fi + + dodir /etc/env.d + + # List all the multilib libdirs + local libdirs + for libdir in $(get_all_libdirs); do + libdirs="${libdirs}:${PREFIX}/${libdir}" + done + + cat < "${D}"/etc/env.d/45kdepaths-${SLOT} # number goes down with version upgrade +PATH=${PREFIX}/bin +ROOTPATH=${PREFIX}/sbin:${PREFIX}/bin +LDPATH=${libdirs:1} +CONFIG_PROTECT="${PREFIX}/share/config ${PREFIX}/env ${PREFIX}/shutdown /usr/share/config" +KDEDIRS="${PREFIX}:/usr:/usr/local" +#KDE_IS_PRELINKED=1 +XDG_DATA_DIRS="/usr/share:${PREFIX}/share:/usr/local/share" +COLON_SEPARATED="XDG_DATA_DIRS" +EOF +} + +pkg_postinst() { + if use zeroconf; then + echo + elog "To make zeroconf support available in KDE make sure that the 'mdnsd' daemon" + elog "is running. Make sure also that multicast dns lookups are enabled by editing" + elog "the 'hosts:' line in /etc/nsswitch.conf to include 'mdns', e.g.:" + elog " hosts: files mdns dns" + echo + fi +}