commit ef9446d57f98b3c5848af8d446582a346e2d62d6 Author: CentOS Sources Date: Tue May 7 05:23:53 2019 -0400 import xalan-j2-2.7.1-38.module+el8+2468+c564cec5 diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..5853c74 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +SOURCES/xalan-j2-2.7.1.tar.gz diff --git a/.xalan-j2.metadata b/.xalan-j2.metadata new file mode 100644 index 0000000..acd6616 --- /dev/null +++ b/.xalan-j2.metadata @@ -0,0 +1 @@ +91d651b76a402a97290ab0afd2a56dd9a9616f56 SOURCES/xalan-j2-2.7.1.tar.gz diff --git a/SOURCES/generate-tarball.sh b/SOURCES/generate-tarball.sh new file mode 100755 index 0000000..bee814c --- /dev/null +++ b/SOURCES/generate-tarball.sh @@ -0,0 +1,22 @@ +#!/bin/bash +set -e + +name=xalan-j2 +version="$(sed -n 's/Version:\s*//p' *.spec)" + +# RETRIEVE +wget "http://archive.apache.org/dist/xml/xalan-j/xalan-j_${version//./_}-src.tar.gz" -O "${name}-${version}.orig.tar.gz" + +rm -rf tarball-tmp +mkdir tarball-tmp +cd tarball-tmp +tar xf "../${name}-${version}.orig.tar.gz" + +# CLEAN TARBALL +find -name '*.jar' -delete +find -name '*.class' -delete +rm */src/*.tar.gz + +tar cf "../${name}-${version}.tar.gz" * +cd .. +rm -r tarball-tmp "${name}-${version}.orig.tar.gz" diff --git a/SOURCES/serializer-2.7.1.pom b/SOURCES/serializer-2.7.1.pom new file mode 100644 index 0000000..79b0027 --- /dev/null +++ b/SOURCES/serializer-2.7.1.pom @@ -0,0 +1,39 @@ + + + + 4.0.0 + + org.apache + apache + 4 + + + xalan + serializer + 2.7.1 + + Xalan Java Serializer + + Serializer to write out XML, HTML etc. as a stream of characters from an input DOM or from input + SAX events. + + http://xml.apache.org/xalan-j/ + + + + xml-apis + xml-apis + 1.3.04 + + + xerces + xercesImpl + 2.9.0 + true + + + + \ No newline at end of file diff --git a/SOURCES/xalan-2.7.1.pom b/SOURCES/xalan-2.7.1.pom new file mode 100644 index 0000000..b4a56e9 --- /dev/null +++ b/SOURCES/xalan-2.7.1.pom @@ -0,0 +1,41 @@ + + + + 4.0.0 + + org.apache + apache + 4 + + + xalan + xalan + 2.7.1 + + Xalan Java + + Xalan-Java is an XSLT processor for transforming XML documents into HTML, + text, or other XML document types. It implements XSL Transformations (XSLT) + Version 1.0 and XML Path Language (XPath) Version 1.0 and can be used from + the command line, in an applet or a servlet, or as a module in other program. + + http://xml.apache.org/xalan-j/ + + + + xalan + serializer + 2.7.1 + + + xerces + xercesImpl + 2.9.0 + true + + + + \ No newline at end of file diff --git a/SOURCES/xalan-j2-CVE-2014-0107.patch b/SOURCES/xalan-j2-CVE-2014-0107.patch new file mode 100644 index 0000000..3358f60 --- /dev/null +++ b/SOURCES/xalan-j2-CVE-2014-0107.patch @@ -0,0 +1,148 @@ +diff --git a/src/org/apache/xalan/processor/TransformerFactoryImpl.java b/src/org/apache/xalan/processor/TransformerFactoryImpl.java +index 1298943..96a5e58 100644 +--- a/src/org/apache/xalan/processor/TransformerFactoryImpl.java ++++ b/src/org/apache/xalan/processor/TransformerFactoryImpl.java +@@ -335,6 +335,10 @@ public class TransformerFactoryImpl extends SAXTransformerFactory + reader = XMLReaderFactory.createXMLReader(); + } + ++ if(m_isSecureProcessing) ++ { ++ reader.setFeature("http://xml.org/sax/features/external-general-entities",false); ++ } + // Need to set options! + reader.setContentHandler(handler); + reader.parse(isource); +diff --git a/src/org/apache/xalan/processor/XSLTElementProcessor.java b/src/org/apache/xalan/processor/XSLTElementProcessor.java +index b946743..17b7395 100644 +--- a/src/org/apache/xalan/processor/XSLTElementProcessor.java ++++ b/src/org/apache/xalan/processor/XSLTElementProcessor.java +@@ -338,17 +338,31 @@ public class XSLTElementProcessor extends ElemTemplateElement + } + else + { +- // Can we switch the order here: +- +- boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, +- attributes.getQName(i), attributes.getValue(i), +- target); +- +- // Now we only add the element if it passed a validation check +- if (success) +- processedDefs.add(attrDef); +- else +- errorDefs.add(attrDef); ++ //handle secure processing ++ if(handler.getStylesheetProcessor()==null) ++ System.out.println("stylesheet processor null"); ++ if(attrDef.getName().compareTo("*")==0 && handler.getStylesheetProcessor().isSecureProcessing()) ++ { ++ //foreign attributes are not allowed in secure processing mode ++ // Then barf, because this element does not allow this attribute. ++ handler.error(XSLTErrorResources.ER_ATTR_NOT_ALLOWED, new Object[]{attributes.getQName(i), rawName}, null);//"\""+attributes.getQName(i)+"\"" ++ //+ " attribute is not allowed on the " + rawName ++ // + " element!", null); ++ } ++ else ++ { ++ ++ ++ boolean success = attrDef.setAttrValue(handler, attrUri, attrLocalName, ++ attributes.getQName(i), attributes.getValue(i), ++ target); ++ ++ // Now we only add the element if it passed a validation check ++ if (success) ++ processedDefs.add(attrDef); ++ else ++ errorDefs.add(attrDef); ++ } + } + } + +diff --git a/src/org/apache/xalan/transformer/TransformerImpl.java b/src/org/apache/xalan/transformer/TransformerImpl.java +index dd0d4d9..0906d24 100644 +--- a/src/org/apache/xalan/transformer/TransformerImpl.java ++++ b/src/org/apache/xalan/transformer/TransformerImpl.java +@@ -438,7 +438,9 @@ public class TransformerImpl extends Transformer + try + { + if (sroot.getExtensions() != null) +- m_extensionsTable = new ExtensionsTable(sroot); ++ //only load extensions if secureProcessing is disabled ++ if(!sroot.isSecureProcessing()) ++ m_extensionsTable = new ExtensionsTable(sroot); + } + catch (javax.xml.transform.TransformerException te) + {te.printStackTrace();} +diff --git a/src/org/apache/xpath/functions/FuncSystemProperty.java b/src/org/apache/xpath/functions/FuncSystemProperty.java +index 4bea356..78ac980 100644 +--- a/src/org/apache/xpath/functions/FuncSystemProperty.java ++++ b/src/org/apache/xpath/functions/FuncSystemProperty.java +@@ -58,7 +58,7 @@ public class FuncSystemProperty extends FunctionOneArg + + String fullName = m_arg0.execute(xctxt).str(); + int indexOfNSSep = fullName.indexOf(':'); +- String result; ++ String result = null; + String propName = ""; + + // List of properties where the name of the +@@ -98,14 +98,20 @@ public class FuncSystemProperty extends FunctionOneArg + + try + { +- result = System.getProperty(propName); +- +- if (null == result) +- { +- +- // result = System.getenv(propName); +- return XString.EMPTYSTRING; +- } ++ //if secure procession is enabled only handle required properties do not not map any valid system property ++ if(!xctxt.isSecureProcessing()) ++ { ++ result = System.getProperty(propName); ++ } ++ else ++ { ++ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, ++ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); ++ } ++ if (null == result) ++ { ++ return XString.EMPTYSTRING; ++ } + } + catch (SecurityException se) + { +@@ -120,14 +126,20 @@ public class FuncSystemProperty extends FunctionOneArg + { + try + { +- result = System.getProperty(fullName); +- +- if (null == result) +- { +- +- // result = System.getenv(fullName); +- return XString.EMPTYSTRING; +- } ++ //if secure procession is enabled only handle required properties do not not map any valid system property ++ if(!xctxt.isSecureProcessing()) ++ { ++ result = System.getProperty(fullName); ++ } ++ else ++ { ++ warn(xctxt, XPATHErrorResources.WG_SECURITY_EXCEPTION, ++ new Object[]{ fullName }); //"SecurityException when trying to access XSL system property: "+fullName); ++ } ++ if (null == result) ++ { ++ return XString.EMPTYSTRING; ++ } + } + catch (SecurityException se) + { diff --git a/SOURCES/xalan-j2-MANIFEST.MF b/SOURCES/xalan-j2-MANIFEST.MF new file mode 100644 index 0000000..f5d77cf --- /dev/null +++ b/SOURCES/xalan-j2-MANIFEST.MF @@ -0,0 +1,75 @@ +Manifest-Version: 1.0 +Ant-Version: Apache Ant 1.8.2 +Created-By: 1.7.0_b147-icedtea (Oracle Corporation) +Main-Class: org.apache.xalan.xslt.Process +Bundle-ManifestVersion: 2 +Bundle-Name: %Bundle-Name.0 +Bundle-SymbolicName: org.apache.xalan +Bundle-Version: 2.7.1 +Bundle-Vendor: %Bundle-Vendor.0 +Export-Package: org.apache.regexp;version="2.7.1", + org.apache.xalan;version="2.7.1", + org.apache.xalan.client;version="2.7.1", + org.apache.xalan.extensions;version="2.7.1", + org.apache.xalan.lib;version="2.7.1", + org.apache.xalan.lib.sql;version="2.7.1", + org.apache.xalan.processor;version="2.7.1", + org.apache.xalan.res;version="2.7.1", + org.apache.xalan.serialize;version="2.7.1", + org.apache.xalan.templates;version="2.7.1", + org.apache.xalan.trace;version="2.7.1", + org.apache.xalan.transformer;version="2.7.1", + org.apache.xalan.xslt;version="2.7.1", + org.apache.xalan.xsltc;version="2.7.1", + org.apache.xalan.xsltc.cmdline;version="2.7.1", + org.apache.xalan.xsltc.cmdline.getopt;version="2.7.1", + org.apache.xalan.xsltc.compiler;version="2.7.1", + org.apache.xalan.xsltc.compiler.util;version="2.7.1", + org.apache.xalan.xsltc.dom;version="2.7.1", + org.apache.xalan.xsltc.runtime;version="2.7.1", + org.apache.xalan.xsltc.runtime.output;version="2.7.1", + org.apache.xalan.xsltc.trax;version="2.7.1", + org.apache.xalan.xsltc.util;version="2.7.1", + org.apache.xml.dtm;version="2.7.1", + org.apache.xml.dtm.ref;version="2.7.1", + org.apache.xml.dtm.ref.dom2dtm;version="2.7.1", + org.apache.xml.dtm.ref.sax2dtm;version="2.7.1", + org.apache.xml.res;version="2.7.1", + org.apache.xml.utils;version="2.7.1", + org.apache.xml.utils.res;version="2.7.1", + org.apache.xpath;version="2.7.1", + org.apache.xpath.axes;version="2.7.1", + org.apache.xpath.compiler;version="2.7.1", + org.apache.xpath.domapi;version="2.7.1", + org.apache.xpath.functions;version="2.7.1", + org.apache.xpath.jaxp;version="2.7.1", + org.apache.xpath.objects;version="2.7.1", + org.apache.xpath.operations;version="2.7.1", + org.apache.xpath.patterns;version="2.7.1", + org.apache.xpath.res;version="2.7.1" +Require-Bundle: system.bundle, org.apache.xerces +Eclipse-BuddyPolicy: registered + +Name: org/apache/xalan/ +Comment: Main Xalan engine implementing TrAX/JAXP +Specification-Title: Java API for XML Processing +Specification-Vendor: Sun Microsystems Inc. +Specification-Version: 1.3 +Implementation-Title: org.apache.xalan +Implementation-Version: 2.7.1 +Implementation-Vendor: Apache Software Foundation +Implementation-URL: http://xml.apache.org/xalan-j/dist/ + +Name: org/apache/xml/ +Comment: DTM implementation and utilities +Implementation-Title: org.apache.xml +Implementation-Version: 2.7.1 +Implementation-Vendor: Apache Software Foundation +Implementation-URL: http://xml.apache.org/xalan-j/dist/ + +Name: org/apache/xpath/ +Comment: XPath engine +Implementation-Title: org.apache.xpath +Implementation-Version: 2.7.1 +Implementation-Vendor: Apache Software Foundation +Implementation-URL: http://xml.apache.org/xalan-j/dist/ diff --git a/SOURCES/xalan-j2-noxsltcdeps.patch b/SOURCES/xalan-j2-noxsltcdeps.patch new file mode 100644 index 0000000..6840741 --- /dev/null +++ b/SOURCES/xalan-j2-noxsltcdeps.patch @@ -0,0 +1,11 @@ +--- build.xml.orig 2007-11-22 23:44:01.000000000 +0200 ++++ build.xml 2010-04-07 13:32:31.878542610 +0300 +@@ -683,7 +683,7 @@ $Id: build.xml 563656 2007-08-07 21:12:1 + + + +- + + diff --git a/SOURCES/xalan-j2-serializer-MANIFEST.MF b/SOURCES/xalan-j2-serializer-MANIFEST.MF new file mode 100644 index 0000000..436d24a --- /dev/null +++ b/SOURCES/xalan-j2-serializer-MANIFEST.MF @@ -0,0 +1,10 @@ +Manifest-Version: 1.0 +Bundle-RequiredExecutionEnvironment: J2SE-1.2 +Bundle-SymbolicName: org.apache.xml.serializer +Bundle-ManifestVersion: 2 +Bundle-Name: %Bundle-Name.0 +Bundle-Localization: plugin +Bundle-Version: 2.7.1.v200806030322 +Bundle-Vendor: %Bundle-Vendor.0 +Export-Package: org.apache.xml.serializer,org.apache.xml.serializer.do + m3 diff --git a/SOURCES/xsltc-2.7.1.pom b/SOURCES/xsltc-2.7.1.pom new file mode 100644 index 0000000..b32dbd0 --- /dev/null +++ b/SOURCES/xsltc-2.7.1.pom @@ -0,0 +1,13 @@ + + 4.0.0 + xalan + xsltc + 2.7.1 + + + xalan + xalan + 2.7.1 + + + diff --git a/SPECS/xalan-j2.spec b/SPECS/xalan-j2.spec new file mode 100644 index 0000000..a4e7386 --- /dev/null +++ b/SPECS/xalan-j2.spec @@ -0,0 +1,605 @@ +# Copyright (c) 2000-2005, JPackage Project +# All rights reserved. +# +# Redistribution and use in source and binary forms, with or without +# modification, are permitted provided that the following conditions +# are met: +# +# 1. Redistributions of source code must retain the above copyright +# notice, this list of conditions and the following disclaimer. +# 2. Redistributions in binary form must reproduce the above copyright +# notice, this list of conditions and the following disclaimer in the +# documentation and/or other materials provided with the +# distribution. +# 3. Neither the name of the JPackage Project nor the names of its +# contributors may be used to endorse or promote products derived +# from this software without specific prior written permission. +# +# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS +# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT +# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR +# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT +# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, +# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT +# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, +# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY +# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT +# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE +# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +# + +%global cvs_version 2_7_1 + +Name: xalan-j2 +Version: 2.7.1 +Release: 38%{?dist} +Epoch: 0 +Summary: Java XSLT processor +# src/org/apache/xpath/domapi/XPathStylesheetDOM3Exception.java is W3C +License: ASL 2.0 and W3C +URL: http://xalan.apache.org/ + +# ./generate-tarball.sh +Source0: %{name}-%{version}.tar.gz +Source1: %{name}-serializer-MANIFEST.MF +Source2: http://repo1.maven.org/maven2/xalan/xalan/2.7.1/xalan-2.7.1.pom +Source3: http://repo1.maven.org/maven2/xalan/serializer/2.7.1/serializer-2.7.1.pom +Source4: xsltc-%{version}.pom +Source5: %{name}-MANIFEST.MF +# Remove bundled binaries which cannot be easily verified for licensing +Source6: generate-tarball.sh + +Patch0: %{name}-noxsltcdeps.patch +# Fix CVE-2014-0107: insufficient constraints in secure processing +# feature (oCERT-2014-002). Generated form upstream revisions 1581058 +# and 1581426. +Patch2: %{name}-CVE-2014-0107.patch + +BuildArch: noarch + +BuildRequires: javapackages-local +BuildRequires: ant +BuildRequires: apache-parent +BuildRequires: bcel +BuildRequires: java_cup +BuildRequires: regexp +BuildRequires: sed +BuildRequires: glassfish-servlet-api +BuildRequires: xerces-j2 >= 0:2.7.1 +BuildRequires: xml-commons-apis >= 0:1.3 + +Requires: xerces-j2 + +Provides: jaxp_transform_impl + +%description +Xalan is an XSLT processor for transforming XML documents into HTML, +text, or other XML document types. It implements the W3C Recommendations +for XSL Transformations (XSLT) and the XML Path Language (XPath). It can +be used from the command line, in an applet or a servlet, or as a module +in other program. + +%package xsltc +Summary: XSLT compiler +License: ASL 2.0 +Requires: java_cup +Requires: bcel +Requires: regexp +Requires: xerces-j2 + +%description xsltc +The XSLT Compiler is a Java-based tool for compiling XSLT stylesheets into +lightweight and portable Java byte codes called translets. + +%package manual +Summary: Manual for %{name} +License: ASL 2.0 + +%description manual +Documentation for %{name}. + +%package javadoc +Summary: Javadoc for %{name} +License: ASL 2.0 + +%description javadoc +Javadoc for %{name}. + +%package demo +Summary: Demo for %{name} +License: ASL 2.0 +Requires: %{name} = %{epoch}:%{version}-%{release} +Requires: glassfish-servlet-api + +%description demo +Demonstrations and samples for %{name}. + +%prep +%setup -q -n xalan-j_%{cvs_version} +%patch0 -p0 +%patch2 -p1 + +find . -name '*.jar' -delete +find . -name '*.class' -delete + +sed -i '/