diff options
Diffstat (limited to 'meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch')
-rw-r--r-- | meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch | 65 |
1 files changed, 65 insertions, 0 deletions
diff --git a/meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch b/meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch new file mode 100644 index 0000000000..e1c9e0bdb9 --- /dev/null +++ b/meta/recipes-devtools/go/go-1.14/CVE-2020-29510.patch | |||
@@ -0,0 +1,65 @@ | |||
1 | From a0bf4d38dc2057d28396594264bbdd43d412de22 Mon Sep 17 00:00:00 2001 | ||
2 | From: Filippo Valsorda <filippo@golang.org> | ||
3 | Date: Tue, 27 Oct 2020 00:21:30 +0100 | ||
4 | Subject: [PATCH] encoding/xml: replace comments inside directives with a space | ||
5 | |||
6 | A Directive (like <!ENTITY xxx []>) can't have other nodes nested inside | ||
7 | it (in our data structure representation), so there is no way to | ||
8 | preserve comments. The previous behavior was to just elide them, which | ||
9 | however might change the semantic meaning of the surrounding markup. | ||
10 | Instead, replace them with a space which hopefully has the same semantic | ||
11 | effect of the comment. | ||
12 | |||
13 | Directives are not actually a node type in the XML spec, which instead | ||
14 | specifies each of them separately (<!ENTITY, <!DOCTYPE, etc.), each with | ||
15 | its own grammar. The rules for where and when the comments are allowed | ||
16 | are not straightforward, and can't be implemented without implementing | ||
17 | custom logic for each of the directives. | ||
18 | |||
19 | Simply preserving the comments in the body of the directive would be | ||
20 | problematic, as there can be unmatched quotes inside the comment. | ||
21 | Whether those quotes are considered meaningful semantically or not, | ||
22 | other parsers might disagree and interpret the output differently. | ||
23 | |||
24 | This issue was reported by Juho Nurminen of Mattermost as it leads to | ||
25 | round-trip mismatches. See #43168. It's not being fixed in a security | ||
26 | release because round-trip stability is not a currently supported | ||
27 | security property of encoding/xml, and we don't believe these fixes | ||
28 | would be sufficient to reliably guarantee it in the future. | ||
29 | |||
30 | Fixes CVE-2020-29510 | ||
31 | Updates #43168 | ||
32 | |||
33 | Change-Id: Icd86c75beff3e1e0689543efebdad10ed5178ce3 | ||
34 | Reviewed-on: https://go-review.googlesource.com/c/go/+/277893 | ||
35 | Run-TryBot: Filippo Valsorda <filippo@golang.org> | ||
36 | TryBot-Result: Go Bot <gobot@golang.org> | ||
37 | Trust: Filippo Valsorda <filippo@golang.org> | ||
38 | Reviewed-by: Katie Hockman <katie@golang.org> | ||
39 | |||
40 | Upstream-Status: Backport from https://github.com/golang/go/commit/a9cfd55e2b09735a25976d1b008a0a3c767494f8 | ||
41 | CVE: CVE-2020-29510 | ||
42 | Signed-off-by: Shubham Kulkarni <skulkarni@mvista.com> | ||
43 | --- | ||
44 | src/encoding/xml/xml.go | 6 ++++++ | ||
45 | 1 file changed, 6 insertions(+) | ||
46 | |||
47 | diff --git a/src/encoding/xml/xml.go b/src/encoding/xml/xml.go | ||
48 | index 01a1460..98647b2 100644 | ||
49 | --- a/src/encoding/xml/xml.go | ||
50 | +++ b/src/encoding/xml/xml.go | ||
51 | @@ -768,6 +768,12 @@ func (d *Decoder) rawToken() (Token, error) { | ||
52 | } | ||
53 | b0, b1 = b1, b | ||
54 | } | ||
55 | + | ||
56 | + // Replace the comment with a space in the returned Directive | ||
57 | + // body, so that markup parts that were separated by the comment | ||
58 | + // (like a "<" and a "!") don't get joined when re-encoding the | ||
59 | + // Directive, taking new semantic meaning. | ||
60 | + d.buf.WriteByte(' ') | ||
61 | } | ||
62 | } | ||
63 | return Directive(d.buf.Bytes()), nil | ||
64 | -- | ||
65 | 2.7.4 | ||