import maven-shared-utils-3.2.1-0.2.module+el8.6.0+15045+b1156105

c8-stream-3.5 imports/c8-stream-3.5/maven-shared-utils-3.2.1-0.2.module+el8.6.0+15045+b1156105
CentOS Sources 3 years ago committed by MSVSphere Packaging Team
commit 3ea67aa042

1
.gitignore vendored

@ -0,0 +1 @@
SOURCES/maven-shared-utils-3.2.1-source-release.zip

@ -0,0 +1 @@
015559e466938c7e9053603d37b96ef3e03b802b SOURCES/maven-shared-utils-3.2.1-source-release.zip

@ -0,0 +1,82 @@
From e3d2a29743e1b36beaf1063567da9dfd2e5a8aa8 Mon Sep 17 00:00:00 2001
From: Michael Simacek <msimacek@redhat.com>
Date: Mon, 26 Feb 2018 16:21:04 +0100
Subject: [PATCH] Restore compatibility with current maven
---
.../maven/shared/utils/logging/AnsiMessageBuilder.java | 18 ++++++++++++++++++
.../maven/shared/utils/logging/MessageBuilder.java | 3 +++
.../shared/utils/logging/PlainMessageBuilder.java | 18 ++++++++++++++++++
3 files changed, 39 insertions(+)
diff --git a/src/main/java/org/apache/maven/shared/utils/logging/AnsiMessageBuilder.java b/src/main/java/org/apache/maven/shared/utils/logging/AnsiMessageBuilder.java
index 0103a6b..23b6d14 100644
--- a/src/main/java/org/apache/maven/shared/utils/logging/AnsiMessageBuilder.java
+++ b/src/main/java/org/apache/maven/shared/utils/logging/AnsiMessageBuilder.java
@@ -153,4 +153,22 @@ class AnsiMessageBuilder
{
return ansi.toString();
}
+
+ @Override
+ public MessageBuilder debug(Object message) {
+ a(message);
+ return this;
+ }
+
+ @Override
+ public MessageBuilder info(Object message) {
+ a(message);
+ return this;
+ }
+
+ @Override
+ public MessageBuilder error(Object message) {
+ a(message);
+ return this;
+ }
}
diff --git a/src/main/java/org/apache/maven/shared/utils/logging/MessageBuilder.java b/src/main/java/org/apache/maven/shared/utils/logging/MessageBuilder.java
index b60bb4e..1dc2624 100644
--- a/src/main/java/org/apache/maven/shared/utils/logging/MessageBuilder.java
+++ b/src/main/java/org/apache/maven/shared/utils/logging/MessageBuilder.java
@@ -26,6 +26,9 @@ package org.apache.maven.shared.utils.logging;
*/
public interface MessageBuilder
{
+ MessageBuilder debug( Object message );
+ MessageBuilder info( Object message );
+ MessageBuilder error( Object message );
/**
* Append message content in success style.
* By default, bold green
diff --git a/src/main/java/org/apache/maven/shared/utils/logging/PlainMessageBuilder.java b/src/main/java/org/apache/maven/shared/utils/logging/PlainMessageBuilder.java
index 2eec001..5236e99 100644
--- a/src/main/java/org/apache/maven/shared/utils/logging/PlainMessageBuilder.java
+++ b/src/main/java/org/apache/maven/shared/utils/logging/PlainMessageBuilder.java
@@ -139,4 +139,22 @@ class PlainMessageBuilder
{
return buffer.toString();
}
+
+ @Override
+ public MessageBuilder debug(Object message) {
+ a(message);
+ return this;
+ }
+
+ @Override
+ public MessageBuilder info(Object message) {
+ a(message);
+ return this;
+ }
+
+ @Override
+ public MessageBuilder error(Object message) {
+ a(message);
+ return this;
+ }
}
--
2.14.3

@ -0,0 +1,319 @@
From c0b225b90d1056e29d681258a2008ae8aff2b508 Mon Sep 17 00:00:00 2001
From: Marian Koncek <mkoncek@redhat.com>
Date: Tue, 5 Apr 2022 13:56:20 +0200
Subject: [PATCH] Unconditionally single quote executable and arguments
Upstream: https://github.com/apache/maven-shared-utils/pull/40/commits
---
.../shared/utils/cli/shell/BourneShell.java | 48 ++++++++-----------
.../maven/shared/utils/cli/shell/Shell.java | 39 ++++++++++-----
.../utils/cli/shell/BourneShellTest.java | 35 ++++++++++----
3 files changed, 72 insertions(+), 50 deletions(-)
diff --git a/src/main/java/org/apache/maven/shared/utils/cli/shell/BourneShell.java b/src/main/java/org/apache/maven/shared/utils/cli/shell/BourneShell.java
index 11a447a..f0de631 100644
--- a/src/main/java/org/apache/maven/shared/utils/cli/shell/BourneShell.java
+++ b/src/main/java/org/apache/maven/shared/utils/cli/shell/BourneShell.java
@@ -23,7 +23,6 @@ package org.apache.maven.shared.utils.cli.shell;
import java.util.ArrayList;
import java.util.List;
import org.apache.maven.shared.utils.Os;
-import org.apache.maven.shared.utils.StringUtils;
/**
* @author Jason van Zyl
@@ -31,17 +30,15 @@ import org.apache.maven.shared.utils.StringUtils;
public class BourneShell
extends Shell
{
- private static final char[] BASH_QUOTING_TRIGGER_CHARS =
- { ' ', '$', ';', '&', '|', '<', '>', '*', '?', '(', ')', '[', ']', '{', '}', '`' };
-
/**
- * Create instance of BournShell.
+ * Create instance of BourneShell.
*/
public BourneShell()
{
+ setUnconditionalQuoting( true );
setShellCommand( "/bin/sh" );
setArgumentQuoteDelimiter( '\'' );
- setExecutableQuoteDelimiter( '\"' );
+ setExecutableQuoteDelimiter( '\'' );
setSingleQuotedArgumentEscaped( true );
setSingleQuotedExecutableEscaped( false );
setQuotedExecutableEnabled( true );
@@ -57,7 +54,7 @@ public class BourneShell
return super.getExecutable();
}
- return unifyQuotes( super.getExecutable() );
+ return quoteOneItem( super.getExecutable(), true );
}
/** {@inheritDoc} */
@@ -110,47 +107,40 @@ public class BourneShell
StringBuilder sb = new StringBuilder();
sb.append( "cd " );
- sb.append( unifyQuotes( dir ) );
+ sb.append( quoteOneItem( dir, false ) );
sb.append( " && " );
return sb.toString();
}
- /** {@inheritDoc} */
- protected char[] getQuotingTriggerChars()
- {
- return BASH_QUOTING_TRIGGER_CHARS;
- }
-
/**
* <p>Unify quotes in a path for the Bourne Shell.</p>
* <p/>
* <pre>
- * BourneShell.unifyQuotes(null) = null
- * BourneShell.unifyQuotes("") = (empty)
- * BourneShell.unifyQuotes("/test/quotedpath'abc") = /test/quotedpath\'abc
- * BourneShell.unifyQuotes("/test/quoted path'abc") = "/test/quoted path'abc"
- * BourneShell.unifyQuotes("/test/quotedpath\"abc") = "/test/quotedpath\"abc"
- * BourneShell.unifyQuotes("/test/quoted path\"abc") = "/test/quoted path\"abc"
- * BourneShell.unifyQuotes("/test/quotedpath\"'abc") = "/test/quotedpath\"'abc"
- * BourneShell.unifyQuotes("/test/quoted path\"'abc") = "/test/quoted path\"'abc"
+ * BourneShell.quoteOneItem(null) = null
+ * BourneShell.quoteOneItem("") = ''
+ * BourneShell.quoteOneItem("/test/quotedpath'abc") = '/test/quotedpath'"'"'abc'
+ * BourneShell.quoteOneItem("/test/quoted path'abc") = '/test/quoted pat'"'"'habc'
+ * BourneShell.quoteOneItem("/test/quotedpath\"abc") = '/test/quotedpath"abc'
+ * BourneShell.quoteOneItem("/test/quoted path\"abc") = '/test/quoted path"abc'
+ * BourneShell.quoteOneItem("/test/quotedpath\"'abc") = '/test/quotedpath"'"'"'abc'
+ * BourneShell.quoteOneItem("/test/quoted path\"'abc") = '/test/quoted path"'"'"'abc'
* </pre>
*
* @param path not null path.
* @return the path unified correctly for the Bourne shell.
*/
- private static String unifyQuotes( String path )
+ protected String quoteOneItem( String path, boolean isExecutable )
{
if ( path == null )
{
return null;
}
- if ( path.indexOf( ' ' ) == -1 && path.indexOf( '\'' ) != -1 && path.indexOf( '"' ) == -1 )
- {
- return StringUtils.escape( path );
- }
-
- return StringUtils.quoteAndEscape( path, '\"', BASH_QUOTING_TRIGGER_CHARS );
+ StringBuilder sb = new StringBuilder();
+ sb.append( "'" );
+ sb.append( path.replace( "'", "'\"'\"'" ) );
+ sb.append( "'" );
+ return sb.toString();
}
}
diff --git a/src/main/java/org/apache/maven/shared/utils/cli/shell/Shell.java b/src/main/java/org/apache/maven/shared/utils/cli/shell/Shell.java
index 6fa2f73..96904cb 100644
--- a/src/main/java/org/apache/maven/shared/utils/cli/shell/Shell.java
+++ b/src/main/java/org/apache/maven/shared/utils/cli/shell/Shell.java
@@ -50,6 +50,8 @@ public class Shell
private boolean quotedArgumentsEnabled = true;
+ private boolean unconditionalQuoting = false;
+
private String executable;
private String workingDir;
@@ -113,6 +115,19 @@ public class Shell
}
}
+ protected String quoteOneItem( String inputString, boolean isExecutable )
+ {
+ char[] escapeChars = getEscapeChars( isSingleQuotedExecutableEscaped(), isDoubleQuotedExecutableEscaped() );
+ return StringUtils.quoteAndEscape(
+ inputString,
+ isExecutable ? getExecutableQuoteDelimiter() : getArgumentQuoteDelimiter(),
+ escapeChars,
+ getQuotingTriggerChars(),
+ '\\',
+ unconditionalQuoting
+ );
+ }
+
/**
* Get the command line for the provided executable and arguments in this shell
*
@@ -145,15 +160,11 @@ public class Shell
if ( isQuotedExecutableEnabled() )
{
- char[] escapeChars =
- getEscapeChars( isSingleQuotedExecutableEscaped(), isDoubleQuotedExecutableEscaped() );
-
- sb.append( StringUtils.quoteAndEscape( getExecutable(), getExecutableQuoteDelimiter(), escapeChars,
- getQuotingTriggerChars(), '\\', false ) );
+ sb.append( quoteOneItem( executableParameter, true ) );
}
else
{
- sb.append( getExecutable() );
+ sb.append( executableParameter );
}
}
for ( String argument : argumentsParameter )
@@ -165,10 +176,7 @@ public class Shell
if ( isQuotedArgumentsEnabled() )
{
- char[] escapeChars = getEscapeChars( isSingleQuotedArgumentEscaped(), isDoubleQuotedArgumentEscaped() );
-
- sb.append( StringUtils.quoteAndEscape( argument, getArgumentQuoteDelimiter(), escapeChars,
- getQuotingTriggerChars(), '\\', false ) );
+ sb.append( quoteOneItem( argument, false ) );
}
else
{
@@ -285,7 +293,7 @@ public class Shell
commandLine.addAll( getShellArgsList() );
}
- commandLine.addAll( getCommandLine( getExecutable(), arguments ) );
+ commandLine.addAll( getCommandLine( executable, arguments ) );
return commandLine;
@@ -398,4 +406,13 @@ public class Shell
this.singleQuotedExecutableEscaped = singleQuotedExecutableEscaped;
}
+ public boolean isUnconditionalQuoting()
+ {
+ return unconditionalQuoting;
+ }
+
+ public void setUnconditionalQuoting( boolean unconditionalQuoting )
+ {
+ this.unconditionalQuoting = unconditionalQuoting;
+ }
}
diff --git a/src/test/java/org/apache/maven/shared/utils/cli/shell/BourneShellTest.java b/src/test/java/org/apache/maven/shared/utils/cli/shell/BourneShellTest.java
index b5f23d9..f5143c1 100644
--- a/src/test/java/org/apache/maven/shared/utils/cli/shell/BourneShellTest.java
+++ b/src/test/java/org/apache/maven/shared/utils/cli/shell/BourneShellTest.java
@@ -44,7 +44,7 @@ public class BourneShellTest
String executable = StringUtils.join( sh.getShellCommandLine( new String[]{} ).iterator(), " " );
- assertEquals( "/bin/sh -c cd /usr/local/bin && chmod", executable );
+ assertEquals( "/bin/sh -c cd '/usr/local/bin' && 'chmod'", executable );
}
public void testQuoteWorkingDirectoryAndExecutable_WDPathWithSingleQuotes()
@@ -56,7 +56,7 @@ public class BourneShellTest
String executable = StringUtils.join( sh.getShellCommandLine( new String[]{} ).iterator(), " " );
- assertEquals( "/bin/sh -c cd \"/usr/local/\'something else\'\" && chmod", executable );
+ assertEquals( "/bin/sh -c cd '/usr/local/'\"'\"'something else'\"'\"'' && 'chmod'", executable );
}
public void testQuoteWorkingDirectoryAndExecutable_WDPathWithSingleQuotes_BackslashFileSep()
@@ -68,7 +68,7 @@ public class BourneShellTest
String executable = StringUtils.join( sh.getShellCommandLine( new String[]{} ).iterator(), " " );
- assertEquals( "/bin/sh -c cd \"\\usr\\local\\\'something else\'\" && chmod", executable );
+ assertEquals( "/bin/sh -c cd '\\usr\\local\\'\"'\"'something else'\"'\"'' && 'chmod'", executable );
}
public void testPreserveSingleQuotesOnArgument()
@@ -78,13 +78,13 @@ public class BourneShellTest
sh.setWorkingDirectory( "/usr/bin" );
sh.setExecutable( "chmod" );
- String[] args = { "\'some arg with spaces\'" };
+ String[] args = { "\"some arg with spaces\"" };
List<String> shellCommandLine = sh.getShellCommandLine( args );
String cli = StringUtils.join( shellCommandLine.iterator(), " " );
System.out.println( cli );
- assertTrue( cli.endsWith( args[0] ) );
+ assertTrue( cli.endsWith( "'\"some arg with spaces\"'" ) );
}
public void testAddSingleQuotesOnArgumentWithSpaces()
@@ -100,7 +100,21 @@ public class BourneShellTest
String cli = StringUtils.join( shellCommandLine.iterator(), " " );
System.out.println( cli );
- assertTrue( cli.endsWith( "\'" + args[0] + "\'" ) );
+ assertTrue( cli.endsWith("'some arg with spaces'"));
+ }
+
+ public void testAddArgumentWithSingleQuote()
+ {
+ Shell sh = newShell();
+
+ sh.setWorkingDirectory( "/usr/bin" );
+ sh.setExecutable( "chmod" );
+
+ String[] args = { "arg'withquote" };
+
+ List<String> shellCommandLine = sh.getShellCommandLine( args );
+
+ assertEquals("cd '/usr/bin' && 'chmod' 'arg'\"'\"'withquote'", shellCommandLine.get(shellCommandLine.size() - 1));
}
public void testArgumentsWithsemicolon()
@@ -119,7 +133,7 @@ public class BourneShellTest
String cli = StringUtils.join( shellCommandLine.iterator(), " " );
System.out.println( cli );
- assertTrue( cli.endsWith( "\'" + args[0] + "\'" ) );
+ assertTrue( cli.endsWith( "';some&argwithunix$chars'" ) );
Commandline commandline = new Commandline( newShell() );
commandline.setExecutable( "chmod" );
@@ -132,7 +146,7 @@ public class BourneShellTest
assertEquals( "/bin/sh", lines.get( 0 ) );
assertEquals( "-c", lines.get( 1 ) );
- assertEquals( "chmod --password ';password'", lines.get( 2 ) );
+ assertEquals( "'chmod' '--password' ';password'", lines.get( 2 ) );
commandline = new Commandline( newShell() );
commandline.setExecutable( "chmod" );
@@ -144,7 +158,7 @@ public class BourneShellTest
assertEquals( "/bin/sh", lines.get( 0) );
assertEquals( "-c", lines.get( 1 ) );
- assertEquals( "chmod --password ';password'", lines.get( 2 ) );
+ assertEquals( "'chmod' '--password' ';password'", lines.get( 2 ) );
commandline = new Commandline( new CmdShell() );
commandline.getShell().setQuotedArgumentsEnabled( true );
@@ -186,13 +200,14 @@ public class BourneShellTest
commandline.createArg().setValue( "{" );
commandline.createArg().setValue( "}" );
commandline.createArg().setValue( "`" );
+ commandline.createArg().setValue( "#" );
List<String> lines = commandline.getShell().getShellCommandLine( commandline.getArguments() );
System.out.println( lines );
assertEquals( "/bin/sh", lines.get( 0 ) );
assertEquals( "-c", lines.get( 1 ) );
- assertEquals( "chmod ' ' '|' '&&' '||' ';' ';;' '&' '()' '<' '<<' '>' '>>' '*' '?' '[' ']' '{' '}' '`'",
+ assertEquals( "'chmod' ' ' '|' '&&' '||' ';' ';;' '&' '()' '<' '<<' '>' '>>' '*' '?' '[' ']' '{' '}' '`' '#'",
lines.get( 2 ) );
}
--
2.35.1

@ -0,0 +1,154 @@
Name: maven-shared-utils
Version: 3.2.1
Release: 0.2%{?dist}
Summary: Maven shared utility classes
License: ASL 2.0
URL: http://maven.apache.org/shared/maven-shared-utils
BuildArch: noarch
Source0: http://repo1.maven.org/maven2/org/apache/maven/shared/%{name}/%{version}/%{name}-%{version}-source-release.zip
# XXX temporary for maven upgrade
Patch0: 0001-Restore-compatibility-with-current-maven.patch
Patch1: 0002-Unconditionally-single-quote-executable-and-argument.patch
BuildRequires: maven-local
BuildRequires: mvn(com.google.code.findbugs:jsr305)
BuildRequires: mvn(commons-io:commons-io)
BuildRequires: mvn(junit:junit)
BuildRequires: mvn(org.apache.commons:commons-lang3)
BuildRequires: mvn(org.apache.maven:maven-core)
BuildRequires: mvn(org.apache.maven.plugin-testing:maven-plugin-testing-harness)
BuildRequires: mvn(org.apache.maven.shared:maven-shared-components:pom:)
BuildRequires: mvn(org.codehaus.plexus:plexus-container-default)
BuildRequires: mvn(org.fusesource.jansi:jansi)
BuildRequires: mvn(org.hamcrest:hamcrest-core)
%description
This project aims to be a functional replacement for plexus-utils in Maven.
It is not a 100% API compatible replacement though but a replacement with
improvements: lots of methods got cleaned up, generics got added and we dropped
a lot of unused code.
%package javadoc
Summary: Javadoc for %{name}
%description javadoc
API documentation for %{name}.
%prep
%setup -q
%patch0 -p1
%patch1 -p1
%pom_remove_plugin org.codehaus.mojo:findbugs-maven-plugin
%build
%mvn_build
%install
%mvn_install
%files -f .mfiles
%license LICENSE NOTICE
%files javadoc -f .mfiles-javadoc
%license LICENSE NOTICE
%changelog
* Tue Apr 05 2022 Marián Konček <mkoncek@redhat.com> - 3.2.1-0.2
- Fix commandline injection vulnerability
- Resolves: CVE-2022-29599
* Mon Feb 26 2018 Michael Simacek <msimacek@redhat.com> - 3.2.1-0.1
- Update to upstream version 3.2.1 (patched temporary)
* Thu Feb 08 2018 Fedora Release Engineering <releng@fedoraproject.org> - 3.1.0-6
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
* Wed Jul 26 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.1.0-5
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
* Mon Feb 13 2017 Michael Simacek <msimacek@redhat.com> - 3.1.0-4
- Regenerate BuildRequires
* Fri Feb 10 2017 Fedora Release Engineering <releng@fedoraproject.org> - 3.1.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
* Wed Jul 27 2016 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.1.0-2
- Re-enable tests
* Fri Jul 22 2016 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.1.0-0.1.RC
- Update to upstream version 3.1.0
- Temporarly disable tests
* Fri Jul 15 2016 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.0.1-2
- Remove unneeded build-requires
* Thu Jun 2 2016 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.0.1-1
- Update to upstream version 3.0.1
* Thu Feb 04 2016 Fedora Release Engineering <releng@fedoraproject.org> - 3.0.0-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild
* Fri Oct 16 2015 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.0.0-2
- Enable all tests
* Mon Oct 12 2015 Mikolaj Izdebski <mizdebsk@redhat.com> - 3.0.0-1
- Update to upstream version 3.0.0
* Mon Sep 21 2015 Mikolaj Izdebski <mizdebsk@redhat.com> - 0.9-1
- Update to upstream version 0.9
* Mon Jun 22 2015 Michal Srb <msrb@redhat.com> - 0.8-1
- Update to upstream release 0.8
* Wed Jun 17 2015 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.7-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild
* Fri Oct 24 2014 Mikolaj Izdebski <mizdebsk@redhat.com> - 0.7-1
- Update to upstream version 0.7
* Sat Jun 07 2014 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.6-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild
* Mon Mar 24 2014 Mikolaj Izdebski <mizdebsk@redhat.com> - 0.6-1
- Update to upstream version 0.6
* Tue Mar 04 2014 Stanislav Ochotnicky <sochotnicky@redhat.com> - 0.5-3
- Use Requires: java-headless rebuild (#1067528)
* Wed Feb 19 2014 Mikolaj Izdebski <mizdebsk@redhat.com> - 0.5-2
- Fix unowned directory
* Mon Dec 23 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 0.5-1
- Update to upstream version 0.5
- Remove patch for MSHARED-285 (accepted upstream)
* Sat Aug 03 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.4-2
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild
* Mon Apr 22 2013 Tomas Radej <tradej@redhat.com> - 0.4-1
- Updated to latest upstream version
- Fixed and reenabled tests
* Mon Apr 08 2013 Michal Srb <msrb@redhat.com> - 0.3-2
- Disable tests (they don't work with junit >= 4.11)
* Fri Mar 15 2013 Michal Srb <msrb@redhat.com> - 0.3-1
- Update to upstream version 0.3
* Tue Feb 19 2013 Mikolaj Izdebski <mizdebsk@redhat.com> - 0.2-4
- Build with xmvn
* Thu Feb 14 2013 Fedora Release Engineering <rel-eng@lists.fedoraproject.org> - 0.2-3
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild
* Wed Feb 06 2013 Java SIG <java-devel@lists.fedoraproject.org> - 0.2-2
- Update for https://fedoraproject.org/wiki/Fedora_19_Maven_Rebuild
- Replace maven BuildRequires with maven-local
* Wed Jan 16 2013 Tomas Radej <tradej@redhat.com> - 0.2-1
- Initial version
Loading…
Cancel
Save