OBS-URL: https://build.opensuse.org/package/show/Java:packages/xmlgraphics-batik?expand=0&rev=65

xmlgraphics-batik-nosourcetarget.patch

@@ -1,47 +0,0 @@
---- batik-1.15/build.xml	2023-10-25 17:01:52.414466777 +0200
-+++ batik-1.15/build.xml	2023-10-25 17:03:22.921750305 +0200
-@@ -94,8 +94,6 @@
-     <property name="debug"              value="on"/>
-     <property name="optimize"           value="on"/>
-     <property name="deprecation"        value="on"/>
--    <property name="javac.source" value="1.7"/>
--    <property name="javac.target" value="1.7"/>
-     <property name="src"                value="sources"/>
-     <property name="src-internal-codec" value="sources-internal-codec"/>
-     <property name="resources"          value="resources"/>
-@@ -712,7 +710,7 @@
- 
-     <echo message="debug ${debug}, optimize ${optimize}, deprecation ${deprecation}"/>
- 
--    <javac source="${javac.source}" target="${javac.target}" destdir="${dest}"  deprecation="${deprecation}" 
-+    <javac destdir="${dest}"  deprecation="${deprecation}" 
-            debug="${debug}" optimize="${optimize}" encoding="UTF-8">
-       <src path="${testsrc}"/>
-       <src path="batik-test/src/main/java"/>
-@@ -743,7 +741,7 @@
- 
-     <echo message="debug ${debug}, optimize ${optimize}, deprecation ${deprecation}"/>
- 
--    <javac source="${javac.source}" target="${javac.target}" srcdir="${samples}/tests/resources/java/sources" destdir="${samples}/tests/resources/java/classes"  deprecation="${deprecation}" 
-+    <javac srcdir="${samples}/tests/resources/java/sources" destdir="${samples}/tests/resources/java/classes"  deprecation="${deprecation}" 
-            debug="${debug}" optimize="${optimize}" encoding="UTF-8">
-       <classpath>
-         <pathelement location="${dest}"/>
-@@ -753,7 +751,7 @@
-       </classpath>
-     </javac>
- 
--    <javac source="${javac.source}" target="${javac.target}" srcdir="${testresources}" destdir="${testresources}/classes"  deprecation="${deprecation}" 
-+    <javac srcdir="${testresources}" destdir="${testresources}/classes"  deprecation="${deprecation}" 
-            debug="${debug}" optimize="${optimize}" encoding="UTF-8">
-       <classpath>
-         <pathelement location="${dest}"/>
-@@ -999,7 +997,7 @@
-   </target>
- 
-   <target name="compile" depends="init, compile-prepare, compile-copy-resources" unless="compile.done">
--    <javac source="${javac.source}" target="${javac.target}" destdir="${dest}" deprecation="${deprecation}" 
-+    <javac destdir="${dest}" deprecation="${deprecation}" 
-            debug="${debug}" optimize="${optimize}" encoding="UTF-8"
-            includeAntRuntime="true">
-       <src path="batik-anim/src/main/java"/>

xmlgraphics-batik.changes

@@ -1,3 +1,20 @@
+-------------------------------------------------------------------
+Fri Mar  1 19:02:03 UTC 2024 - Fridrich Strba <fstrba@suse.com>
+
+- Upgrade to version 1.17
+  * BATIK-1346: Allow configuration of rhino whitelist
+  * BATIK-1347: Switch to empty whitelist for rhino (CVE-2022-44730)
+  * BATIK-1349: Block loading external resource by default
+    (CVE-2022-44729)
+- Upgrade to version 1.16
+  * Java 8 or later is minimum runtime required
+  * BATIK-1338: Block loading jar inside svg (CVE-2022-41704)
+  * BATIK-1345: Restrict what java classes can be run thru rhino
+    (CVE-2022-42890)
+- Removed patch:
+  * xmlgraphics-batik-nosourcetarget.patch
+    + not needed since Java 8 compatibility is now the default
+
 -------------------------------------------------------------------
 Thu Feb 29 07:18:22 UTC 2024 - Fridrich Strba <fstrba@suse.com>
 

xmlgraphics-batik.spec

@@ -21,7 +21,7 @@
 %define _buildshell /bin/bash
 %global classpath xmlgraphics-batik:rhino:xml-commons-apis:xml-commons-apis-ext:xmlgraphics-commons
 Name:           xmlgraphics-batik
-Version:        1.15
+Version:        1.17
 Release:        0
 Summary:        Scalable Vector Graphics for Java
 License:        Apache-2.0
@@ -32,7 +32,6 @@ Source1:        batik-build.tar.xz
 Source7:        %{name}.security.policy
 Patch0:         %{name}-nolinksinjavadoc.patch
 Patch1:         0001-Fix-imageio-codec-lookup.patch
-Patch2:         %{name}-nosourcetarget.patch
 BuildRequires:  ant
 BuildRequires:  fdupes
 BuildRequires:  java-devel >= 1.8
@@ -167,19 +166,13 @@ find -name '*.jar' -delete
 
 %patch -P 0 -p1
 %patch -P 1 -p1
-%patch -P 2 -p1
 
 cp -p %{SOURCE7} batik-svgrasterizer/src/main/resources/org/apache/batik/apps/rasterizer/resources/rasterizer.policy
 cp -p %{SOURCE7} batik-svgbrowser/src/main/resources/org/apache/batik/apps/svgbrowser/resources/svgbrowser.policy
 
-# It's an uberjar, it shouldn't have requires
-%pom_xpath_inject pom:dependency '<optional>true</optional>' batik-all
-
 # eclipse expects xmlgraphics to be optional
 %pom_xpath_inject 'pom:dependency[pom:artifactId="xmlgraphics-commons"]' '<optional>true</optional>' batik-css
 
-%pom_remove_dep :batik-i18n batik-util
-
 for pom in `find -mindepth 2 -name pom.xml -not -path ./batik-all/pom.xml`; do
     %pom_add_plugin org.apache.felix:maven-bundle-plugin $pom "
         <extensions>true</extensions>
@@ -209,7 +202,6 @@ export OPT_JAR_LIST=:
     -f build-batik.xml -Dtest.skip=true \
 	package
 %{ant} \
-    -Dant.build.javac.source=8 -Dant.build.javac.target=8 \
     all-jar jars javadoc
 
 %install