Merge remote-tracking branch 'neoclust/rawhide' into rawhide

07f316957b59d305f04c7bdb26292852bcbc2eb5.patch

@@ -0,0 +1,36 @@
+From 07f316957b59d305f04c7bdb26292852bcbc2eb5 Mon Sep 17 00:00:00 2001
+From: Rolf Lear <rolf@tuis.net>
+Date: Thu, 1 Jul 2021 23:56:47 -0400
+Subject: [PATCH] Update test case to ensure DTD handling is OK again. Related
+ #188. Related #189
+
+---
+ test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java b/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java
+index a69380ba..a35a1b90 100644
+--- a/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java
++++ b/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java
+@@ -101,6 +101,7 @@ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ import org.jdom2.DefaultJDOMFactory;
+ import org.jdom2.Document;
+ import org.jdom2.EntityRef;
++import org.jdom2.JDOMConstants;
+ import org.jdom2.JDOMException;
+ import org.jdom2.JDOMFactory;
+ import org.jdom2.UncheckedJDOMFactory;
+@@ -609,11 +610,12 @@ public void testSetExternalFeature() {
+ 			XMLReader reader = sb.createParser();
+ 			assertNotNull(reader);
+ 			assertTrue(reader.getFeature(feature));
++			assertNull(reader.getProperty(JDOMConstants.SAX_PROPERTY_DECLARATION_HANDLER));
+ 			sb.setFeature(feature, false);
+ 			reader = sb.createParser();
+ 			assertNotNull(reader);
+ 			assertFalse(reader.getFeature(feature));
+-
++			assertNotNull(reader.getProperty(JDOMConstants.SAX_PROPERTY_DECLARATION_HANDLER));
+ 		} catch (Exception e) {
+ 			e.printStackTrace();
+ 			fail("Could not create parser: " + e.getMessage());

bd3ab78370098491911d7fe9d7a43b97144a234e.patch

@@ -0,0 +1,69 @@
+From bd3ab78370098491911d7fe9d7a43b97144a234e Mon Sep 17 00:00:00 2001
+From: Esti <esther.burs@gmail.com>
+Date: Thu, 18 Feb 2021 16:40:01 +0200
+Subject: [PATCH] fix setFeature bug and add test case
+
+---
+ core/src/java/org/jdom2/input/SAXBuilder.java | 10 ++++------
+ .../test/cases/input/TestSAXBuilder.java      | 20 +++++++++++++++++++
+ 2 files changed, 24 insertions(+), 6 deletions(-)
+
+diff --git a/core/src/java/org/jdom2/input/SAXBuilder.java b/core/src/java/org/jdom2/input/SAXBuilder.java
+index d7105ec6..a1462334 100644
+--- a/core/src/java/org/jdom2/input/SAXBuilder.java
++++ b/core/src/java/org/jdom2/input/SAXBuilder.java
+@@ -971,11 +971,6 @@ protected void configureParser(final XMLReader parser, final SAXHandler contentH
+ 			}
+ 		}
+ 
+-		// Set any user-specified features on the parser.
+-		for (final Map.Entry<String, Boolean> me : features.entrySet()) {
+-			internalSetFeature(parser, me.getKey(), me.getValue().booleanValue(), me.getKey());
+-		}
+-
+ 		// Set any user-specified properties on the parser.
+ 		for (final Map.Entry<String, Object> me : properties.entrySet()) {
+ 			internalSetProperty(parser, me.getKey(), me.getValue(), me.getKey());
+@@ -1007,7 +1002,10 @@ protected void configureParser(final XMLReader parser, final SAXHandler contentH
+ 				// No lexical reporting available
+ 			}
+ 		}
+-
++		// Set any user-specified features on the parser.
++		for (final Map.Entry<String, Boolean> me : features.entrySet()) {
++			internalSetFeature(parser, me.getKey(), me.getValue().booleanValue(), me.getKey());
++		}
+ 	}
+ 
+ 	/**
+diff --git a/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java b/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java
+index 4ef34834..a69380ba 100644
+--- a/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java
++++ b/test/src/java/org/jdom2/test/cases/input/TestSAXBuilder.java
+@@ -600,6 +600,26 @@ public void testSetFeature() {
+ 		}
+ 	}
+ 
++	@Test
++	public void testSetExternalFeature() {
++		String feature = "http://xml.org/sax/features/external-general-entities";
++		MySAXBuilder sb = new MySAXBuilder();
++		try {
++			sb.setFeature(feature, true);
++			XMLReader reader = sb.createParser();
++			assertNotNull(reader);
++			assertTrue(reader.getFeature(feature));
++			sb.setFeature(feature, false);
++			reader = sb.createParser();
++			assertNotNull(reader);
++			assertFalse(reader.getFeature(feature));
++
++		} catch (Exception e) {
++			e.printStackTrace();
++			fail("Could not create parser: " + e.getMessage());
++		}
++	}
++
+ 	@Test
+ 	public void testSetProperty() {
+ 		LexicalHandler lh = new LexicalHandler() {

dd4f3c2fc7893edd914954c73eb577f925a7d361.patch

@@ -0,0 +1,34 @@
+From dd4f3c2fc7893edd914954c73eb577f925a7d361 Mon Sep 17 00:00:00 2001
+From: Rolf Lear <rolf@tuis.net>
+Date: Thu, 1 Jul 2021 23:42:05 -0400
+Subject: [PATCH] Addresses #189 - synchronizes external entity expansion
+ setting
+
+---
+ core/src/java/org/jdom2/input/SAXBuilder.java | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/core/src/java/org/jdom2/input/SAXBuilder.java b/core/src/java/org/jdom2/input/SAXBuilder.java
+index a1462334..514b026d 100644
+--- a/core/src/java/org/jdom2/input/SAXBuilder.java
++++ b/core/src/java/org/jdom2/input/SAXBuilder.java
+@@ -82,6 +82,7 @@ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ import org.jdom2.DocType;
+ import org.jdom2.Document;
+ import org.jdom2.EntityRef;
++import org.jdom2.JDOMConstants;
+ import org.jdom2.JDOMException;
+ import org.jdom2.JDOMFactory;
+ import org.jdom2.Verifier;
+@@ -797,6 +798,11 @@ public void setFastReconfigure(final boolean fastReconfigure) {
+ 	public void setFeature(final String name, final boolean value) {
+ 		// Save the specified feature for later.
+ 		features.put(name, value ? Boolean.TRUE : Boolean.FALSE);
++		if (JDOMConstants.SAX_FEATURE_EXTERNAL_ENT.equals(name)) {
++			// See issue https://github.com/hunterhacker/jdom/issues/189
++			// And PR https://github.com/hunterhacker/jdom/pull/188
++			setExpandEntities(value);
++		}
+ 		engine = null;
+ 	}
+ 

jdom2.spec

@@ -2,7 +2,7 @@
 
 Name:          jdom2
 Version:       2.0.6
-Release:       23%{?dist}
+Release:       24%{?dist}
 Summary:       Java manipulation of XML made easy
 License:       Saxpath
 URL:           http://www.jdom.org/
@@ -17,6 +17,15 @@ Source4:       generate-tarball.sh
 # Process contrib and junit pom files
 Patch0:        0001-Adapt-build.patch
 
+#
+# Security patches
+# P100 -> ...
+#
+# CVE-2021-33813
+Patch100:      bd3ab78370098491911d7fe9d7a43b97144a234e.patch
+Patch101:      dd4f3c2fc7893edd914954c73eb577f925a7d361.patch
+Patch102:      07f316957b59d305f04c7bdb26292852bcbc2eb5.patch
+
 BuildRequires: javapackages-local
 %if %{with bootstrap}
 BuildRequires:  javapackages-bootstrap
@@ -49,6 +58,10 @@ This package contains javadoc for %{name}.
 
 %patch0 -p1
 
+%patch100 -p1
+%patch101 -p1
+%patch102 -p1
+
 sed -i 's/\r//' LICENSE.txt README.txt
 
 # Unable to run coverage: use log4j12 but switch to log4j 2.x
@@ -80,6 +93,10 @@ mkdir lib
 %license LICENSE.txt
 
 %changelog
+* Thu Oct 14 2021 Mikolaj Izdebski <mizdebsk@redhat.com> - 2.0.6-24
+- Add patches to address DoS security vulnerability
+- Resolves: CVE-2021-33813
+
 * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.0.6-23
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild