From 503819225c9f68678b0888b93220dca79fcc310b Mon Sep 17 00:00:00 2001 From: shixuantong Date: Thu, 27 Jul 2023 20:53:19 +0800 Subject: [PATCH] upgrade version to 3.2.2 --- backport-0001-CVE-2023-28756.patch | 28 ------- backport-0002-CVE-2023-28756.patch | 26 ------ backport-CVE-2023-28755.patch | 28 ------- backport-CVE-2023-36617.patch | 22 ++--- ...kie_new_with_domain-to-pass-on-older.patch | 39 --------- ...osen-the-domain-regex-to-accept-.-29.patch | 44 ---------- ...-console-size-as-optional-dependency.patch | 38 --------- ...ort-irb-Drop-hard-dependency-on-RDoc.patch | 26 ------ ...0-Enable-configuration-of-archlibdir.patch | 5 +- ...ed-paths-when-empty-version-string-i.patch | 7 +- ruby-2.1.0-always-use-i386.patch | 5 +- ruby-2.1.0-custom-rubygems-location.patch | 11 +-- ruby-2.3.0-ruby_version.patch | 32 +++---- ruby-2.7.0-Initialize-ABRT-hook.patch | 7 +- ..._bug_reporter_add-witout-raising-err.patch | 9 +- ruby-3.1.3.tar.xz => ruby-3.2.2.tar.xz | Bin 15300224 -> 15118856 bytes ruby.spec | 79 +++++++++--------- 17 files changed, 77 insertions(+), 329 deletions(-) delete mode 100644 backport-0001-CVE-2023-28756.patch delete mode 100644 backport-0002-CVE-2023-28756.patch delete mode 100644 backport-CVE-2023-28755.patch delete mode 100644 backport-Fix-test_cgi_cookie_new_with_domain-to-pass-on-older.patch delete mode 100644 backport-Loosen-the-domain-regex-to-accept-.-29.patch delete mode 100644 backport-Make-io-console-size-as-optional-dependency.patch delete mode 100644 backport-irb-Drop-hard-dependency-on-RDoc.patch rename ruby-3.1.3.tar.xz => ruby-3.2.2.tar.xz (62%) diff --git a/backport-0001-CVE-2023-28756.patch b/backport-0001-CVE-2023-28756.patch deleted file mode 100644 index 0c8ba5e..0000000 --- a/backport-0001-CVE-2023-28756.patch +++ /dev/null @@ -1,28 +0,0 @@ -From b57db51f577875d3e896dcd2ef1dcaf97f23e943 Mon Sep 17 00:00:00 2001 -From: Nobuyoshi Nakada -Date: Tue, 29 Nov 2022 16:22:15 +0900 -Subject: [PATCH] Fix quadratic backtracking on invalid time - -https://hackerone.com/reports/1485501 ---- - lib/time.rb | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/time.rb b/lib/time.rb -index 43c4d80..2c85f94 100644 ---- a/lib/time.rb -+++ b/lib/time.rb -@@ -509,8 +509,8 @@ class Time - (Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec)\s+ - (\d{2,})\s+ - (\d{2})\s* -- :\s*(\d{2})\s* -- (?::\s*(\d{2}))?\s+ -+ :\s*(\d{2}) -+ (?:\s*:\s*(\d{2}))?\s+ - ([+-]\d{4}| - UT|GMT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|[A-IK-Z])/ix =~ date - # Since RFC 2822 permit comments, the regexp has no right anchor. --- -2.33.0 - diff --git a/backport-0002-CVE-2023-28756.patch b/backport-0002-CVE-2023-28756.patch deleted file mode 100644 index 3fdeb3f..0000000 --- a/backport-0002-CVE-2023-28756.patch +++ /dev/null @@ -1,26 +0,0 @@ -From 3dce6f73d14f5fad6d9b302393fd02df48797b11 Mon Sep 17 00:00:00 2001 -From: Nobuyoshi Nakada -Date: Fri, 30 Dec 2022 14:32:05 +0900 -Subject: [PATCH] Make RFC2822 regexp linear - -https://hackerone.com/reports/1485501 ---- - lib/time.rb | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/lib/time.rb b/lib/time.rb -index 2c85f94..6a13212 100644 ---- a/lib/time.rb -+++ b/lib/time.rb -@@ -510,7 +510,7 @@ class Time - (\d{2,})\s+ - (\d{2})\s* - :\s*(\d{2}) -- (?:\s*:\s*(\d{2}))?\s+ -+ (?:\s*:\s*(\d\d))?\s+ - ([+-]\d{4}| - UT|GMT|EST|EDT|CST|CDT|MST|MDT|PST|PDT|[A-IK-Z])/ix =~ date - # Since RFC 2822 permit comments, the regexp has no right anchor. --- -2.33.0 - diff --git a/backport-CVE-2023-28755.patch b/backport-CVE-2023-28755.patch deleted file mode 100644 index 1fdfe7f..0000000 --- a/backport-CVE-2023-28755.patch +++ /dev/null @@ -1,28 +0,0 @@ -From eaf89cc31619d49e67c64d0b58ea9dc38892d175 Mon Sep 17 00:00:00 2001 -From: Nobuyoshi Nakada -Date: Mon, 10 Jan 2022 01:12:57 +0900 -Subject: [PATCH] Fix quadratic backtracking on invalid URI - -https://hackerone.com/reports/1444501 ---- - lib/uri/rfc3986_parser.rb | 4 ++-- - 1 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb -index 3e07de4..3c89311 100644 ---- a/lib/uri/rfc3986_parser.rb -+++ b/lib/uri/rfc3986_parser.rb -@@ -3,8 +3,8 @@ module URI - class RFC3986_Parser # :nodoc: - # URI defined in RFC3986 - # this regexp is modified not to host is not empty string -- RFC3986_URI = /\A(?(?[A-Za-z][+\-.0-9A-Za-z]*):(?\/\/(?(?:(?(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*)@)?(?(?\[(?:(?(?:\h{1,4}:){6}(?\h{1,4}:\h{1,4}|(?(?[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g\.\g\.\g))|::(?:\h{1,4}:){5}\g|\h{1,4}?::(?:\h{1,4}:){4}\g|(?:(?:\h{1,4}:)?\h{1,4})?::(?:\h{1,4}:){3}\g|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?v\h+\.[!$&-.0-;=A-Z_a-z~]+))\])|\g|(?(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])+))?(?::(?\d*))?)(?(?:\/(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*))*)|(?\/(?:(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])+)(?:\/\g)*)?)|(?\g(?:\/\g)*)|(?))(?:\?(?[^#]*))?(?:\#(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*))?)\z/ -- RFC3986_relative_ref = /\A(?(?\/\/(?(?:(?(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*)@)?(?(?\[(?(?:\h{1,4}:){6}(?\h{1,4}:\h{1,4}|(?(?[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g\.\g\.\g))|::(?:\h{1,4}:){5}\g|\h{1,4}?::(?:\h{1,4}:){4}\g|(?:(?:\h{1,4}:){,1}\h{1,4})?::(?:\h{1,4}:){3}\g|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?v\h+\.[!$&-.0-;=A-Z_a-z~]+)\])|\g|(?(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])+))?(?::(?\d*))?)(?(?:\/(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*))*)|(?\/(?:(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])+)(?:\/\g)*)?)|(?(?(?:%\h\h|[!$&-.0-9;=@-Z_a-z~])+)(?:\/\g)*)|(?))(?:\?(?[^#]*))?(?:\#(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*))?)\z/ -+ RFC3986_URI = /\A(?(?[A-Za-z][+\-.0-9A-Za-z]*+):(?\/\/(?(?:(?(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*+)@)?(?(?\[(?:(?(?:\h{1,4}:){6}(?\h{1,4}:\h{1,4}|(?(?[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g\.\g\.\g))|::(?:\h{1,4}:){5}\g|\h{1,4}?::(?:\h{1,4}:){4}\g|(?:(?:\h{1,4}:)?\h{1,4})?::(?:\h{1,4}:){3}\g|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?v\h++\.[!$&-.0-;=A-Z_a-z~]++))\])|\g|(?(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])*+))(?::(?\d*+))?)(?(?:\/(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*+))*+)|(?\/(?:(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])++)(?:\/\g)*+)?)|(?\g(?:\/\g)*+)|(?))(?:\?(?[^#]*+))?(?:\#(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*+))?)\z/ -+ RFC3986_relative_ref = /\A(?(?\/\/(?(?:(?(?:%\h\h|[!$&-.0-;=A-Z_a-z~])*+)@)?(?(?\[(?:(?(?:\h{1,4}:){6}(?\h{1,4}:\h{1,4}|(?(?[1-9]\d|1\d{2}|2[0-4]\d|25[0-5]|\d)\.\g\.\g\.\g))|::(?:\h{1,4}:){5}\g|\h{1,4}?::(?:\h{1,4}:){4}\g|(?:(?:\h{1,4}:){,1}\h{1,4})?::(?:\h{1,4}:){3}\g|(?:(?:\h{1,4}:){,2}\h{1,4})?::(?:\h{1,4}:){2}\g|(?:(?:\h{1,4}:){,3}\h{1,4})?::\h{1,4}:\g|(?:(?:\h{1,4}:){,4}\h{1,4})?::\g|(?:(?:\h{1,4}:){,5}\h{1,4})?::\h{1,4}|(?:(?:\h{1,4}:){,6}\h{1,4})?::)|(?v\h++\.[!$&-.0-;=A-Z_a-z~]++))\])|\g|(?(?:%\h\h|[!$&-.0-9;=A-Z_a-z~])++))?(?::(?\d*+))?)(?(?:\/(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])*+))*+)|(?\/(?:(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~])++)(?:\/\g)*+)?)|(?(?(?:%\h\h|[!$&-.0-9;=@-Z_a-z~])++)(?:\/\g)*+)|(?))(?:\?(?[^#]*+))?(?:\#(?(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*+))?)\z/ - attr_reader :regexp - - def initialize --- -2.39.1 - diff --git a/backport-CVE-2023-36617.patch b/backport-CVE-2023-36617.patch index 25433c5..b1e50fb 100644 --- a/backport-CVE-2023-36617.patch +++ b/backport-CVE-2023-36617.patch @@ -15,10 +15,10 @@ Subject: [PATCH] CVE-2023-36617 for Ruby 3.1 (#7996) 5 files changed, 28 insertions(+), 6 deletions(-) diff --git a/lib/bundler/vendor/uri/lib/uri/rfc2396_parser.rb b/lib/bundler/vendor/uri/lib/uri/rfc2396_parser.rb -index e48e164..09ed407 100644 +index 2f8d553..09c22c9 100644 --- a/lib/bundler/vendor/uri/lib/uri/rfc2396_parser.rb +++ b/lib/bundler/vendor/uri/lib/uri/rfc2396_parser.rb -@@ -491,8 +491,8 @@ module Bundler::URI +@@ -497,8 +497,8 @@ module Bundler::URI ret = {} # for Bundler::URI::split @@ -30,10 +30,10 @@ index e48e164..09ed407 100644 # for Bundler::URI::extract ret[:URI_REF] = Regexp.new(pattern[:URI_REF]) diff --git a/lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb b/lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb -index 2029cfd..e11f622 100644 +index d527072..a85511c 100644 --- a/lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb +++ b/lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb -@@ -95,7 +95,7 @@ module Bundler::URI +@@ -100,7 +100,7 @@ module Bundler::URI QUERY: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, FRAGMENT: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, OPAQUE: /\A(?:[^\/].*)?\z/, @@ -58,10 +58,10 @@ index 76a8f99..00c66cf 100644 # for URI::extract ret[:URI_REF] = Regexp.new(pattern[:URI_REF]) diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb -index 3c89311..cde3ea7 100644 +index dd24a40..9b1663d 100644 --- a/lib/uri/rfc3986_parser.rb +++ b/lib/uri/rfc3986_parser.rb -@@ -101,7 +101,7 @@ module URI +@@ -100,7 +100,7 @@ module URI QUERY: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, FRAGMENT: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/, OPAQUE: /\A(?:[^\/].*)?\z/, @@ -71,12 +71,12 @@ index 3c89311..cde3ea7 100644 end diff --git a/test/uri/test_parser.rb b/test/uri/test_parser.rb -index 03de137..81c2210 100644 +index 72fb590..cee0acb 100644 --- a/test/uri/test_parser.rb +++ b/test/uri/test_parser.rb -@@ -63,4 +63,26 @@ class URI::TestParser < Test::Unit::TestCase - assert_equal("\u3042", p1.unescape('%e3%81%82'.force_encoding(Encoding::US_ASCII))) - assert_equal("\xe3\x83\x90\xe3\x83\x90", p1.unescape("\xe3\x83\x90%e3%83%90")) +@@ -79,4 +79,26 @@ class URI::TestParser < Test::Unit::TestCase + assert_equal([nil, nil, "example.com", nil, nil, "", nil, nil, nil], URI.split("//example.com")) + assert_equal([nil, nil, "[0::0]", nil, nil, "", nil, nil, nil], URI.split("//[0::0]")) end + + def test_rfc2822_parse_relative_uri @@ -102,5 +102,5 @@ index 03de137..81c2210 100644 + end end -- -2.27.0 +2.33.0 diff --git a/backport-Fix-test_cgi_cookie_new_with_domain-to-pass-on-older.patch b/backport-Fix-test_cgi_cookie_new_with_domain-to-pass-on-older.patch deleted file mode 100644 index d0aaa2b..0000000 --- a/backport-Fix-test_cgi_cookie_new_with_domain-to-pass-on-older.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 05f0c58048540e868d9bbc6e49151b27e1bc89e9 Mon Sep 17 00:00:00 2001 -From: Jean Boussier -Date: Wed, 23 Nov 2022 12:10:36 +0100 -Subject: [PATCH] Fix test_cgi_cookie_new_with_domain to pass on older rubies - ---- - test/cgi/test_cgi_cookie.rb | 8 ++++---- - 1 files changed, 4 insertions(+), 4 deletions(-) - -diff --git a/test/cgi/test_cgi_cookie.rb b/test/cgi/test_cgi_cookie.rb -index e3ec4be..6d31932 100644 ---- a/test/cgi/test_cgi_cookie.rb -+++ b/test/cgi/test_cgi_cookie.rb -@@ -62,18 +62,18 @@ class CGICookieTest < Test::Unit::TestCase - - def test_cgi_cookie_new_with_domain - h = {'name'=>'name1', 'value'=>'value1'} -- cookie = CGI::Cookie.new('domain'=>'a.example.com', **h) -+ cookie = CGI::Cookie.new(h.merge('domain'=>'a.example.com')) - assert_equal('a.example.com', cookie.domain) - -- cookie = CGI::Cookie.new('domain'=>'1.example.com', **h) -+ cookie = CGI::Cookie.new(h.merge('domain'=>'1.example.com')) - assert_equal('1.example.com', cookie.domain, 'enhanced by RFC 1123') - - assert_raise(ArgumentError) { -- CGI::Cookie.new('domain'=>'-a.example.com', **h) -+ CGI::Cookie.new(h.merge('domain'=>'-a.example.com')) - } - - assert_raise(ArgumentError) { -- CGI::Cookie.new('domain'=>'a-.example.com', **h) -+ CGI::Cookie.new(h.merge('domain'=>'a-.example.com')) - } - end - --- -2.33.0 - diff --git a/backport-Loosen-the-domain-regex-to-accept-.-29.patch b/backport-Loosen-the-domain-regex-to-accept-.-29.patch deleted file mode 100644 index a5c9c2b..0000000 --- a/backport-Loosen-the-domain-regex-to-accept-.-29.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 5e09d632f3b56d85b2659ab47d5571ae9e270e10 Mon Sep 17 00:00:00 2001 -From: Xenor Chang -Date: Mon, 28 Nov 2022 12:34:06 +0800 -Subject: [PATCH] Loosen the domain regex to accept '.' (#29) - -* Loosen the domain regex to accept '.' - -Co-authored-by: Nobuyoshi Nakada -Co-authored-by: Hiroshi SHIBATA ---- - lib/cgi/cookie.rb | 2 +- - test/cgi/test_cgi_cookie.rb | 3 +++ - 2 files changed, 4 insertions(+), 1 deletion(-) - -diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb -index 1a9c1a8..9498e2f 100644 ---- a/lib/cgi/cookie.rb -+++ b/lib/cgi/cookie.rb -@@ -42,7 +42,7 @@ class CGI - - TOKEN_RE = %r"\A[[!-~]&&[^()<>@,;:\\\"/?=\[\]{}]]+\z" - PATH_VALUE_RE = %r"\A[[ -~]&&[^;]]*\z" -- DOMAIN_VALUE_RE = %r"\A(?