add note about security issues

OBS-URL: https://build.opensuse.org/package/show/devel:libraries:c_c++/gumbo-parser?expand=0&rev=18

0.12.1.tar.gz

@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:a0ff2e1b613403fe69ff6407f3f93221fdfa67da357be158bb1e6903b33c1c10
+size 2115338

gumbo-parser.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Tue Nov 21 21:56:25 UTC 2023 - Carsten Ziepke <kieltux@gmail.com>
+
+- Update to version 0.12.1
+  * Fix empty the end of the tag <form>
+  * Correctly handle text in <form> elements
+  * Fix tag name filtering that could result in XSS
+- Changes in version 0.12.0
+  * Add support for <dialog> tag
+  * Fix TAGSET_INCLUDES macro to work properly with multiple
+    bit flags
+  * Avoid potential crash for zero length tags
+- Changes in version 0.11.0
+  * Add support for <picture> tag
+  * Make genperf.py script compatible with Python 3
+- Update project and download URL to new maintained fork
+
 -------------------------------------------------------------------
 Wed Oct 26 21:22:06 UTC 2016 - jengelh@inai.de
 

gumbo-parser.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package gumbo-parser
 #
-# Copyright (c) 2015 SUSE LINUX Products GmbH, Nuernberg, Germany.
+# Copyright (c) 2023 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -12,23 +12,33 @@
 # license that conforms to the Open Source Definition (Version 1.9)
 # published by the Open Source Initiative.
 
-# Please submit bugfixes or comments via http://bugs.opensuse.org/
+# Please submit bugfixes or comments via https://bugs.opensuse.org/
 #
 
+#
+# """
+# It [gumbo] was in Factory previously.
+#
+# gumbo development was discontinued. There are "serious problems" ascribed to
+# it. The codeberg gumbo-parser fork [as of 2024-09-27] does not address them.
+# The nokogiri fork on the other hand is internal to nokogiri.
+#
+# https://bugzilla.suse.com/show_bug.cgi?id=1208381
+#
+# I would recommend people to switch away from gumbo and towards libxml2's 
+# HTML parser.
+# """ --jengelh (private mail archive)
 
+%define lname   libgumbo2
 Name:           gumbo-parser
-%define lname   libgumbo1
+Version:        0.12.1
-Version:        0.10.1
 Release:        0
-Summary:        Google's HTML5 parser library for C99
+Summary:        An HTML5 parsing library in pure C99
 License:        Apache-2.0
 Group:          Development/Libraries/C and C++
-Url:            http://github.com/google/gumbo-parser
+URL:            https://codeberg.org/grisha/gumbo-parser
-
+Source:         https://codeberg.org/grisha/gumbo-parser/archive/%version.tar.gz
-#Git-Clone:	git://github.com/google/gumbo-parser
+BuildRequires:  autoconf
-Source:         https://github.com/google/gumbo-parser/archive/v%version.tar.gz
-BuildRoot:      %{_tmppath}/%{name}-%{version}-build
-BuildRequires:  autoconf >= 2.65
 BuildRequires:  automake
 BuildRequires:  gcc-c++
 BuildRequires:  libtool
@@ -41,7 +51,7 @@ specification, robust and resilient to bad input, supports source
 locations and pointers back to the original text.
 
 %package -n %lname
-Summary:        Google's HTML5 parser library
+Summary:        An HTML5 parsing library
 Group:          System/Libraries
 
 %description -n %lname
@@ -50,12 +60,14 @@ as a C99 library. It is fully conformant with the HTML5
 specification, robust and resilient to bad input, supports source
 locations and pointers back to the original text.
 
-%package -n libgumbo-devel
+%package devel
-Summary:        Development files for Google's C99 HTML5 parser
+Summary:        Development files for HTML5 parser
 Group:          Development/Libraries/C and C++
 Requires:       %lname = %version
+Obsoletes:      libgumbo-devel < %version-%release
+Provides:       libgumbo-devel = %version-%release
 
-%description -n libgumbo-devel
+%description devel
 Gumbo is an implementation of the HTML5 parsing algorithm implemented
 as a C99 library. It is fully conformant with the HTML5
 specification, robust and resilient to bad input, supports source
@@ -65,7 +77,7 @@ This subpackage contains libraries and header files for developing
 applications that want to make use of gumbo-parser.
 
 %prep
-%autosetup
+%autosetup -n gumbo-parser
 
 %build
 %define _configure ../configure
@@ -73,23 +85,23 @@ mkdir -p m4 obj
 autoreconf -fi
 pushd obj
 %configure --includedir="%_includedir/%name" --disable-static
-make %{?_smp_mflags}
+%make_build
 popd
 
 %install
 pushd obj
 %make_install docdir="%_defaultdocdir/%name"
 popd
-find "%buildroot/%_libdir" -type f -name "*.la" -delete
+find %buildroot -type f -name "*.la" -delete -print
 
 %post   -n %lname -p /sbin/ldconfig
 %postun -n %lname -p /sbin/ldconfig
 
 %files -n %lname
-%_libdir/libgumbo.so.1*
+%_libdir/libgumbo.so.2*
-%license COPYING
+%license doc/COPYING
 
-%files -n libgumbo-devel
+%files devel
 %_includedir/%name/
 %_libdir/libgumbo.so
 %_libdir/pkgconfig/gumbo.pc

v0.10.1.tar.gz

@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:28463053d44a5dfbc4b77bcf49c8cee119338ffa636cc17fc3378421d714efad
-size 2119285