ce9ccab169
- Update to 0.12.11:
Features:
* Auto-update static category data from fd.o
* Implement support for input control relations
* validator: Validate input control relations
* validator: Put AppStream technical terms and tag names in backticks in
explanation texts
* Modernize the README
* validator: Check for uppercase letters in cids
* Strip beginning/trailing newlines in a number of places
* Make AsContext getter for AsComponent public API
* qt: Add support for name_variant_suffix
* Make component sort-score API public API
* Implement a YAML representation of release artifact information
Specification:
* Build specification and docs with DAPS
* docs: Add (HTML) anchors for requires/recommends items
* spec: Specify user input control recommendations
* docs: Don't show reference to nonexistent provides->service tag for services
* spec: Encourage the use of only lowercase letters for component-IDs
* docs: Document --explain flag in ascli manual page as well
* docs: Add permalink anchors to some list entries
* Formally support BLAKE2b/s as hash functions for release artifacts
* docs: Link to the MetaInfo Creator webapp in a few places
Bugfixes:
* Be less noisy about ignoring excessively long search tokens
* Tighten the "free license" check and prevent false positives
* cache: Use correct fts value per result (David Hewitt)
* validator: Control items can't have a version
* validator: Reduce download timeout
OBS-URL: https://build.opensuse.org/request/show/818388
OBS-URL: https://build.opensuse.org/package/show/KDE:Frameworks5/AppStream?expand=0&rev=56
95 lines
3.2 KiB
Diff
95 lines
3.2 KiB
Diff
From 178c01d2fa12fe8b0676e1676d0d40613f167c69 Mon Sep 17 00:00:00 2001
|
|
From: Matthias Klumpp <matthias@tenstral.net>
|
|
Date: Wed, 13 May 2020 21:45:32 +0200
|
|
Subject: [PATCH] Properly escape markup when fixing invalid description data
|
|
|
|
This resolves https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=960491
|
|
and possibly more issues when AppStream was fed broken metainfo files.
|
|
---
|
|
src/as-xml.c | 26 +++++++++++++++-----------
|
|
src/as-xml.h | 2 +-
|
|
2 files changed, 16 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/src/as-xml.c b/src/as-xml.c
|
|
index 962bdf9a..1935e37b 100644
|
|
--- a/src/as-xml.c
|
|
+++ b/src/as-xml.c
|
|
@@ -112,10 +112,10 @@ as_xml_dump_node (xmlNode *node, gchar **content, gssize *len)
|
|
}
|
|
|
|
/**
|
|
- * as_xml_dump_node_content:
|
|
+ * as_xml_dump_node_content_raw:
|
|
*/
|
|
gchar*
|
|
-as_xml_dump_node_content (xmlNode *node)
|
|
+as_xml_dump_node_content_raw (xmlNode *node)
|
|
{
|
|
g_autofree gchar *content = NULL;
|
|
gchar *tmp;
|
|
@@ -170,10 +170,10 @@ as_xml_dump_node_children (xmlNode *node)
|
|
}
|
|
|
|
/**
|
|
- * as_xml_dump_desc_para_node_content:
|
|
+ * as_xml_dump_desc_para_node_content_raw:
|
|
*/
|
|
static gchar*
|
|
-as_xml_dump_desc_para_node_content (xmlNode *node)
|
|
+as_xml_dump_desc_para_node_content_raw (xmlNode *node)
|
|
{
|
|
gboolean is_valid_markup = TRUE;
|
|
|
|
@@ -198,11 +198,15 @@ as_xml_dump_desc_para_node_content (xmlNode *node)
|
|
* was deemed valid. Otherwise we will just try to dump any string content, and hope
|
|
* people call the validator on their files to see that their metadata is broken.
|
|
* TODO: Parse the data properly, and remove only the bad nodes on error, if libxml permits
|
|
- * that somehow? */
|
|
- if (is_valid_markup)
|
|
- return as_xml_dump_node_content (node);
|
|
- else
|
|
- return as_xml_get_node_value (node);
|
|
+ * that in an efficient way? */
|
|
+ if (G_LIKELY (is_valid_markup)) {
|
|
+ return as_xml_dump_node_content_raw (node);
|
|
+ } else {
|
|
+ g_autofree gchar *tmp = as_xml_get_node_value (node);
|
|
+ if (G_UNLIKELY (tmp == NULL))
|
|
+ return NULL;
|
|
+ return g_markup_escape_text (tmp, -1);
|
|
+ }
|
|
}
|
|
|
|
/**
|
|
@@ -405,7 +409,7 @@ as_xml_parse_metainfo_description_node (AsContext *ctx, xmlNode *node, GHFunc fu
|
|
g_hash_table_insert (desc, g_strdup (lang), str);
|
|
}
|
|
|
|
- content = as_xml_dump_desc_para_node_content (iter);
|
|
+ content = as_xml_dump_desc_para_node_content_raw (iter);
|
|
if (content != NULL)
|
|
g_string_append_printf (str, "<p>%s</p>\n", content);
|
|
|
|
@@ -443,7 +447,7 @@ as_xml_parse_metainfo_description_node (AsContext *ctx, xmlNode *node, GHFunc fu
|
|
g_hash_table_insert (desc, g_strdup (lang), str);
|
|
}
|
|
|
|
- content = as_xml_dump_desc_para_node_content (iter2);
|
|
+ content = as_xml_dump_desc_para_node_content_raw (iter2);
|
|
if (content != NULL)
|
|
g_string_append_printf (str, " <%s>%s</%s>\n", (gchar*) iter2->name, content, (gchar*) iter2->name);
|
|
}
|
|
diff --git a/src/as-xml.h b/src/as-xml.h
|
|
index 50a38082..ff1efc56 100644
|
|
--- a/src/as-xml.h
|
|
+++ b/src/as-xml.h
|
|
@@ -53,7 +53,7 @@ void as_xml_parse_metainfo_description_node (AsContext *ctx,
|
|
GHFunc func,
|
|
gpointer entity);
|
|
|
|
-gchar *as_xml_dump_node_content (xmlNode *node);
|
|
+gchar *as_xml_dump_node_content_raw (xmlNode *node);
|
|
gchar *as_xml_dump_node_children (xmlNode *node);
|
|
|
|
void as_xml_add_description_node (AsContext *ctx,
|