Skip to content

Commit 47df674

Browse files
add patch for ruby CVE-2024-35176 (#9267)
Co-authored-by: minghe <rmhsawyer> Co-authored-by: Mykhailo Bykhovtsev <108374904+mbykhovtsev-ms@users.noreply.github.com>
1 parent 84f1470 commit 47df674

2 files changed

Lines changed: 156 additions & 1 deletion

File tree

SPECS/ruby/CVE-2024-35176.patch

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
Patch taken from https://github.com/ruby/rexml/pull/126/files#diff-93b40740603234e79b1d9be5ff2b3af80f3964a146183cbd698f14d7336726e9
2+
diff -ruN a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
3+
--- a/.bundle/gems/rexml-3.2.5/lib/parsers/baseparser.rb 2021-04-05 04:43:38.000000000 -0700
4+
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb 2024-05-28 18:53:32.656078157 -0700
5+
@@ -589,60 +589,41 @@
6+
def parse_attributes(prefixes, curr_ns)
7+
attributes = {}
8+
closed = false
9+
- match_data = @source.match(/^(.*?)(\/)?>/um, true)
10+
- if match_data.nil?
11+
- message = "Start tag isn't ended"
12+
- raise REXML::ParseException.new(message, @source)
13+
- end
14+
-
15+
- raw_attributes = match_data[1]
16+
- closed = !match_data[2].nil?
17+
- return attributes, closed if raw_attributes.nil?
18+
- return attributes, closed if raw_attributes.empty?
19+
-
20+
- scanner = StringScanner.new(raw_attributes)
21+
- until scanner.eos?
22+
- if scanner.scan(/\s+/)
23+
- break if scanner.eos?
24+
- end
25+
-
26+
- pos = scanner.pos
27+
- loop do
28+
- break if scanner.scan(ATTRIBUTE_PATTERN)
29+
- unless scanner.scan(QNAME)
30+
- message = "Invalid attribute name: <#{scanner.rest}>"
31+
- raise REXML::ParseException.new(message, @source)
32+
- end
33+
- name = scanner[0]
34+
- unless scanner.scan(/\s*=\s*/um)
35+
+ while true
36+
+ if @source.match(">", true)
37+
+ return attributes, closed
38+
+ elsif @source.match("/>", true)
39+
+ closed = true
40+
+ return attributes, closed
41+
+ elsif match = @source.match(QNAME, true)
42+
+ name = match[1]
43+
+ prefix = match[2]
44+
+ local_part = match[3]
45+
+ unless @source.match(/\s*=\s*/um, true)
46+
message = "Missing attribute equal: <#{name}>"
47+
raise REXML::ParseException.new(message, @source)
48+
end
49+
- quote = scanner.scan(/['"]/)
50+
- unless quote
51+
+ unless match = @source.match(/(['"])(.*?)\1\s*/um, true)
52+
+ if match = @source.match(/(['"])/, true)
53+
+ message =
54+
+ "Missing attribute value end quote: <#{name}>: <#{match[1]}>"
55+
+ raise REXML::ParseException.new(message, @source)
56+
+ else
57+
+ message = "Missing attribute value start quote: <#{name}>"
58+
+ raise REXML::ParseException.new(message, @source)
59+
+ end
60+
+ unless match = @source.match(/(['"])/, true)
61+
message = "Missing attribute value start quote: <#{name}>"
62+
raise REXML::ParseException.new(message, @source)
63+
end
64+
- unless scanner.scan(/.*#{Regexp.escape(quote)}/um)
65+
- match_data = @source.match(/^(.*?)(\/)?>/um, true)
66+
- if match_data
67+
- scanner << "/" if closed
68+
- scanner << ">"
69+
- scanner << match_data[1]
70+
- scanner.pos = pos
71+
- closed = !match_data[2].nil?
72+
- next
73+
- end
74+
- message =
75+
- "Missing attribute value end quote: <#{name}>: <#{quote}>"
76+
+ quote = match[1]
77+
+ value = @source.read_until(quote)
78+
+ unless value.chomp!(quote)
79+
+ message = "Missing attribute value end quote: <#{name}>: <#{quote}>"
80+
raise REXML::ParseException.new(message, @source)
81+
end
82+
- end
83+
- name = scanner[1]
84+
- prefix = scanner[2]
85+
- local_part = scanner[3]
86+
- # quote = scanner[4]
87+
- value = scanner[5]
88+
+ value = match[2]
89+
+ @source.match(/\s*/um, true)
90+
if prefix == "xmlns"
91+
if local_part == "xml"
92+
if value != "http://www.w3.org/XML/1998/namespace"
93+
diff -ruN a/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb
94+
--- a/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb 2021-04-05 04:43:38.000000000 -0700
95+
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb 2024-05-28 17:10:36.356913505 -0700
96+
@@ -81,7 +81,11 @@
97+
rv
98+
end
99+
100+
- def read
101+
+ def read(term = nil)
102+
+ end
103+
+
104+
+ def read_until(term)
105+
+ @scanner.scan_until(Regexp.union(term)) or @scanner.rest
106+
end
107+
108+
def consume( pattern )
109+
@@ -204,11 +208,28 @@
110+
rv
111+
end
112+
113+
- def read
114+
+ def read(term = nil)
115+
begin
116+
- @buffer << readline
117+
+ @scanner << readline(term)
118+
+ true
119+
rescue Exception, NameError
120+
@source = nil
121+
+ false
122+
+ end
123+
+ end
124+
+
125+
+ def read_until(term)
126+
+ pattern = Regexp.union(term)
127+
+ data = []
128+
+ begin
129+
+ until str = @scanner.scan_until(pattern)
130+
+ @scanner << readline(term)
131+
+ end
132+
+ rescue EOFError
133+
+ @scanner.rest
134+
+ else
135+
+ read if @scanner.eos? and !@source.eof?
136+
+ str
137+
end
138+
end
139+
140+
@@ -263,8 +284,8 @@
141+
end
142+
143+
private
144+
- def readline
145+
- str = @source.readline(@line_break)
146+
+ def readline(term = nil)
147+
+ str = @source.readline(term || @line_break)
148+
if @pending_buffer
149+
if str.nil?
150+
str = @pending_buffer

SPECS/ruby/ruby.spec

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ Name: ruby
8383
# provides should be versioned according to the ruby version.
8484
# More info: https://stdgems.org/
8585
Version: 3.1.4
86-
Release: 5%{?dist}
86+
Release: 6%{?dist}
8787
License: (Ruby OR BSD) AND Public Domain AND MIT AND CC0 AND zlib AND UCD
8888
Vendor: Microsoft Corporation
8989
Distribution: Mariner
@@ -102,6 +102,8 @@ Patch0: CVE-2023-36617.patch
102102
Patch1: CVE-2024-27280.patch
103103
Patch2: CVE-2024-27281.patch
104104
Patch3: CVE-2024-27282.patch
105+
# Patch no longer needed if REXML gem is 3.2.7 or later. Now is 3.2.5
106+
Patch4: CVE-2024-35176.patch
105107
BuildRequires: openssl-devel
106108
BuildRequires: readline
107109
BuildRequires: readline-devel
@@ -404,6 +406,9 @@ sudo -u test make test TESTS="-v"
404406
%{_rpmconfigdir}/rubygems.con
405407

406408
%changelog
409+
* Thu May 30 2024 Minghe Ren <mingheren@microsoft.com> - 3.1.4-6
410+
- Patch CVE-2024-35176
411+
407412
* Thu May 16 2024 Jonathan Behrens <jbehrens@microsoft.com> - 3.1.4-5
408413
- Patch CVE-2024-27282
409414

0 commit comments

Comments
 (0)