diff --git a/CVE-2021-22880-1.patch b/CVE-2021-22880-1.patch deleted file mode 100644 index 22923433cab2dedc5b727392ee05cec25231d290..0000000000000000000000000000000000000000 --- a/CVE-2021-22880-1.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 63e8026805ae9e78ef44efd72e07aeca5c2244fe Mon Sep 17 00:00:00 2001 -From: wang_yue111 <648774160@qq.com> -Date: Mon, 15 Mar 2021 11:14:45 +0800 -Subject: [PATCH] Fix possible DoS vector in PostgreSQL money type - -Carefully crafted input can cause a DoS via the regular expressions used -for validating the money format in the PostgreSQL adapter. This patch -fixes the regexp. - -Thanks to @dee-see from Hackerone for this patch! - -[CVE-2021-22880] ---- - lib/active_record/connection_adapters/postgresql/oid/money.rb | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/lib/active_record/connection_adapters/postgresql/oid/money.rb b/lib/active_record/connection_adapters/postgresql/oid/money.rb -index 6434377..3703e9a 100644 ---- a/lib/active_record/connection_adapters/postgresql/oid/money.rb -+++ b/lib/active_record/connection_adapters/postgresql/oid/money.rb -@@ -26,9 +26,9 @@ module ActiveRecord - - value = value.sub(/^\((.+)\)$/, '-\1') # (4) - case value -- when /^-?\D+[\d,]+\.\d{2}$/ # (1) -+ when /^-?\D*+[\d,]+\.\d{2}$/ # (1) - value.gsub!(/[^-\d.]/, "") -- when /^-?\D+[\d.]+,\d{2}$/ # (2) -+ when /^-?\D*+[\d.]+,\d{2}$/ # (2) - value.gsub!(/[^-\d,]/, "").sub!(/,/, ".") - end - --- -2.23.0 - diff --git a/CVE-2021-22880-2.patch b/CVE-2021-22880-2.patch deleted file mode 100644 index 94b75b703416b9dc81f8316c67bb4f7035334d7a..0000000000000000000000000000000000000000 --- a/CVE-2021-22880-2.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 13b0efd97b9ec1b755d011ea2d0eceee70c5ae37 Mon Sep 17 00:00:00 2001 -From: wang_yue111 <648774160@qq.com> -Date: Tue, 16 Mar 2021 10:46:45 +0800 -Subject: [PATCH] test CVE-2021-22880 - ---- - .../test/cases/adapters/postgresql/money_test.rb | 8 ++++++++ - 1 file changed, 8 insertions(+) - -diff --git a/rails-5.2.4.4/activerecord/test/cases/adapters/postgresql/money_test.rb b/rails-5.2.4.4/activerecord/test/cases/adapters/postgresql/money_test.rb -index 61e75e7..cb31413 100644 ---- a/rails-5.2.4.4/activerecord/test/cases/adapters/postgresql/money_test.rb -+++ b/rails-5.2.4.4/activerecord/test/cases/adapters/postgresql/money_test.rb -@@ -58,6 +58,14 @@ def test_money_type_cast - assert_equal(-2.25, type.cast("($2.25)".dup)) - end - -+ def test_money_regex_backtracking -+ type = PostgresqlMoney.type_for_attribute("wealth") -+ Timeout.timeout(0.1) do -+ assert_equal(0.0, type.cast("$" + "," * 100000 + ".11!")) -+ assert_equal(0.0, type.cast("$" + "." * 100000 + ",11!")) -+ end -+ end -+ - def test_schema_dumping - output = dump_table_schema("postgresql_moneys") - assert_match %r{t\.money\s+"wealth",\s+scale: 2$}, output --- -2.23.0 - diff --git a/activerecord-5.2.4.4.gem b/activerecord-5.2.4.4.gem deleted file mode 100644 index 48830512bb777a229f614234833c3e33af563359..0000000000000000000000000000000000000000 Binary files a/activerecord-5.2.4.4.gem and /dev/null differ diff --git a/activerecord-6.1.4.1-tests.txz b/activerecord-6.1.4.1-tests.txz new file mode 100644 index 0000000000000000000000000000000000000000..24357f4686c938d6e236b3b90091e81c6c189d15 Binary files /dev/null and b/activerecord-6.1.4.1-tests.txz differ diff --git a/activerecord-6.1.4.1.gem b/activerecord-6.1.4.1.gem new file mode 100644 index 0000000000000000000000000000000000000000..edb7d98c565ec50826a6c8010fec065021fa4fee Binary files /dev/null and b/activerecord-6.1.4.1.gem differ diff --git a/rails-6.1.4.1-tools.txz b/rails-6.1.4.1-tools.txz new file mode 100644 index 0000000000000000000000000000000000000000..2a295780575dec0533adacc500837f9b5da9206a Binary files /dev/null and b/rails-6.1.4.1-tools.txz differ diff --git a/rubygem-activerecord.spec b/rubygem-activerecord.spec index 98db0ed0320233590a494c753458def91c70eafa..530e9d2829b31bf7c08d6c67d0ad200632384374 100644 --- a/rubygem-activerecord.spec +++ b/rubygem-activerecord.spec @@ -1,20 +1,27 @@ %global gem_name activerecord Name: rubygem-%{gem_name} Epoch: 1 -Version: 5.2.4.4 -Release: 2 +Version: 6.1.4.1 +Release: 1 Summary: Object-relational mapper framework (part of Rails) License: MIT URL: http://rubyonrails.org -Source0: https://rubygems.org/gems/activerecord-5.2.4.4.gem -Source1: https://github.com/rails/rails/archive/v5.2.4.4.tar.gz -Patch0: CVE-2021-22880-1.patch -Patch1: CVE-2021-22880-2.patch +Source0: https://rubygems.org/gems/%{gem_name}-%{version}.gem +# The gem doesn't ship with the test suite. +# You may check it out like so +# git clone http://github.com/rails/rails.git +# cd rails/activerecord && git archive -v -o activerecord-6.1.4.1-tests.txz v6.1.4.1 test/ +Source1: activerecord-%{version}-tests.txz +# The tools are needed for the test suite, are however unpackaged in gem file. +# You may check it out like so +# git clone http://github.com/rails/rails.git --no-checkout +# cd rails && git archive -v -o rails-6.1.4.1-tools.txz v6.1.4.1 tools/ +Source2: rails-%{version}-tools.txz Suggests: %{_bindir}/sqlite3 BuildRequires: rubygems-devel rubygem(bcrypt) rubygem(activesupport) = %{version} BuildRequires: rubygem(activemodel) = %{version} rubygem(builder) rubygem(sqlite3) -BuildRequires: rubygem(mocha) rubygem(arel) rubygem(rack) sqlite +BuildRequires: rubygem(actionpack) = %{version} rubygem(pg) rubygem(mocha) rubygem(rack) BuildArch: noarch %description Implements the ActiveRecord pattern (Fowler, PoEAA) for ORM. It ties database @@ -30,11 +37,7 @@ BuildArch: noarch Documentation for %{name}. %prep -%setup -q -n %{gem_name}-%{version} -b 1 -%patch0 -p1 -pushd %{_builddir} -%patch1 -p1 -popd +%setup -q -n %{gem_name}-%{version} -b1 -b2 %build gem build ../%{gem_name}-%{version}.gemspec @@ -47,20 +50,13 @@ cp -a .%{gem_dir}/* \ %check pushd .%{gem_instdir} -cp -a %{_builddir}/rails-%{version}/%{gem_name}/test test -sed -i '/^\s*def test_too_many_binds$/ a skip' \ - test/cases/bind_parameter_test.rb -sed -i '/^\s*def test_preloading_has_many_through_with_implicit_source$/ a skip' \ - test/cases/associations/eager_test.rb -sed -i '/^\s*def test_eager_habtm_with_association_inheritance$/ a skip' \ - test/cases/associations/eager_test.rb -ruby -Itest:lib < - 6.1.4.1-1 +- update to 6.1.4.1 + * Tue Mar 16 2021 wangyue - 5.2.4.4-2 - fix CVE-2021-22880 diff --git a/v5.2.4.4.tar.gz b/v5.2.4.4.tar.gz deleted file mode 100644 index 6191daf33e0601a05f29c470eca8d428974f5e8e..0000000000000000000000000000000000000000 Binary files a/v5.2.4.4.tar.gz and /dev/null differ