diff options
author | Shubham Kulkarni <skulkarni@mvista.com> | 2023-04-21 19:25:58 +0530 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2023-04-26 04:19:07 -1000 |
commit | 6dd66704290f81a5ca4c3d7e13e4137be5f07dba (patch) | |
tree | dadbe8df5069066ce5f62a22944cc65b09e039d4 /meta/recipes-devtools/go | |
parent | 51a1d78e2af26be39587f29c3d169a35a7ae150e (diff) | |
download | poky-6dd66704290f81a5ca4c3d7e13e4137be5f07dba.tar.gz |
go: Security fix for CVE-2020-29510
encoding/xml: replace comments inside directives with a space
Backport from https://github.com/golang/go/commit/a9cfd55e2b09735a25976d1b008a0a3c767494f8
(From OE-Core rev: 76d855f3d2c250ac85ca6f24bf0e178fb32607f9)
Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-devtools/go')
-rw-r--r-- | meta/recipes-devtools/go/go-1.14.inc | 1 | ||||
-rw-r--r-- | meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch | 65 |
2 files changed, 66 insertions, 0 deletions
diff --git a/meta/recipes-devtools/go/go-1.14.inc b/meta/recipes-devtools/go/go-1.14.inc index 8df9d62612..7178739b7e 100644 --- a/meta/recipes-devtools/go/go-1.14.inc +++ b/meta/recipes-devtools/go/go-1.14.inc | |||
@@ -55,6 +55,7 @@ SRC_URI += "\ | |||
55 | file://CVE-2022-41723.patch \ | 55 | file://CVE-2022-41723.patch \ |
56 | file://CVE-2022-41722-1.patch \ | 56 | file://CVE-2022-41722-1.patch \ |
57 | file://CVE-2022-41722-2.patch \ | 57 | file://CVE-2022-41722-2.patch \ |
58 | file://CVE-2020-29510.patch \ | ||
58 | " | 59 | " |
59 | 60 | ||
60 | SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" | 61 | SRC_URI_append_libc-musl = " file://0009-ld-replace-glibc-dynamic-linker-with-musl.patch" |
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch b/meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch new file mode 100644 index 0000000000..e1c9e0bdb9 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch | |||
@@ -0,0 +1,65 @@ | |||
1 | From a0bf4d38dc2057d28396594264bbdd43d412de22 Mon Sep 17 00:00:00 2001 | ||
2 | From: Filippo Valsorda <filippo@golang.org> | ||
3 | Date: Tue, 27 Oct 2020 00:21:30 +0100 | ||
4 | Subject: [PATCH] encoding/xml: replace comments inside directives with a space | ||
5 | |||
6 | A Directive (like <!ENTITY xxx []>) can't have other nodes nested inside | ||
7 | it (in our data structure representation), so there is no way to | ||
8 | preserve comments. The previous behavior was to just elide them, which | ||
9 | however might change the semantic meaning of the surrounding markup. | ||
10 | Instead, replace them with a space which hopefully has the same semantic | ||
11 | effect of the comment. | ||
12 | |||
13 | Directives are not actually a node type in the XML spec, which instead | ||
14 | specifies each of them separately (<!ENTITY, <!DOCTYPE, etc.), each with | ||
15 | its own grammar. The rules for where and when the comments are allowed | ||
16 | are not straightforward, and can't be implemented without implementing | ||
17 | custom logic for each of the directives. | ||
18 | |||
19 | Simply preserving the comments in the body of the directive would be | ||
20 | problematic, as there can be unmatched quotes inside the comment. | ||
21 | Whether those quotes are considered meaningful semantically or not, | ||
22 | other parsers might disagree and interpret the output differently. | ||
23 | |||
24 | This issue was reported by Juho Nurminen of Mattermost as it leads to | ||
25 | round-trip mismatches. See #43168. It's not being fixed in a security | ||
26 | release because round-trip stability is not a currently supported | ||
27 | security property of encoding/xml, and we don't believe these fixes | ||
28 | would be sufficient to reliably guarantee it in the future. | ||
29 | |||
30 | Fixes CVE-2020-29510 | ||
31 | Updates #43168 | ||
32 | |||
33 | Change-Id: Icd86c75beff3e1e0689543efebdad10ed5178ce3 | ||
34 | Reviewed-on: https://go-review.googlesource.com/c/go/+/277893 | ||
35 | Run-TryBot: Filippo Valsorda <filippo@golang.org> | ||
36 | TryBot-Result: Go Bot <gobot@golang.org> | ||
37 | Trust: Filippo Valsorda <filippo@golang.org> | ||
38 | Reviewed-by: Katie Hockman <katie@golang.org> | ||
39 | |||
40 | Upstream-Status: Backport from https://github.com/golang/go/commit/a9cfd55e2b09735a25976d1b008a0a3c767494f8 | ||
41 | CVE: CVE-2020-29510 | ||
42 | Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> | ||
43 | --- | ||
44 | src/encoding/xml/xml.go | 6 ++++++ | ||
45 | 1 file changed, 6 insertions(+) | ||
46 | |||
47 | diff --git a/src/encoding/xml/xml.go b/src/encoding/xml/xml.go | ||
48 | index 01a1460..98647b2 100644 | ||
49 | --- a/src/encoding/xml/xml.go | ||
50 | +++ b/src/encoding/xml/xml.go | ||
51 | @@ -768,6 +768,12 @@ func (d *Decoder) rawToken() (Token, error) { | ||
52 | } | ||
53 | b0, b1 = b1, b | ||
54 | } | ||
55 | + | ||
56 | + // Replace the comment with a space in the returned Directive | ||
57 | + // body, so that markup parts that were separated by the comment | ||
58 | + // (like a "<" and a "!") don't get joined when re-encoding the | ||
59 | + // Directive, taking new semantic meaning. | ||
60 | + d.buf.WriteByte(' ') | ||
61 | } | ||
62 | } | ||
63 | return Directive(d.buf.Bytes()), nil | ||
64 | -- | ||
65 | 2.7.4 | ||