6 Commits

5 changed files with 99 additions and 115 deletions

View File

@@ -1,6 +1,6 @@
--- xstream-1.4.18/pom.xml 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/pom.xml 2021-09-28 07:44:32.141757059 +0200
@@ -576,13 +576,13 @@
--- xstream-1.4.21/pom.xml 2024-11-08 07:05:32.047133297 +0100
+++ xstream-1.4.21/pom.xml 2024-11-08 07:05:44.177219055 +0100
@@ -587,13 +587,13 @@
</dependency>
<dependency>
@@ -18,7 +18,7 @@
<version>${version.xpp3}</version>
</dependency>
<dependency>
@@ -595,11 +595,6 @@
@@ -606,11 +606,6 @@
<artifactId>kxml2</artifactId>
<version>${version.net.sf.kxml.kxml2}</version>
</dependency>
@@ -30,7 +30,7 @@
<dependency>
<groupId>org.json</groupId>
@@ -1151,7 +1146,6 @@
@@ -1163,7 +1158,6 @@
<version.commons.lang>2.4</version.commons.lang>
<version.dom4j>1.6.1</version.dom4j>
<version.hsqldb>2.2.8</version.hsqldb>
@@ -38,9 +38,9 @@
<version.javaassist>3.12.1.GA</version.javaassist>
<version.javax.activation>1.1.1</version.javax.activation>
<version.javax.annotation.api>1.3.2</version.javax.annotation.api>
--- xstream-1.4.18/xstream/pom.xml 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream/pom.xml 2021-09-28 07:43:49.593498733 +0200
@@ -69,8 +69,8 @@
--- xstream-1.4.21/xstream/pom.xml 2024-11-08 07:05:32.043799940 +0100
+++ xstream-1.4.21/xstream/pom.xml 2024-11-08 07:05:44.177219055 +0100
@@ -63,8 +63,8 @@
</dependency>
<dependency>
@@ -51,7 +51,7 @@
</dependency>
<dependency>
@@ -90,7 +90,6 @@
@@ -84,7 +84,6 @@
<dependency>
<groupId>xpp3</groupId>
<artifactId>xpp3_min</artifactId>
@@ -59,8 +59,8 @@
</dependency>
<dependency>
--- xstream-1.4.18/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDomDriver.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDomDriver.java 1970-01-01 01:00:00.000000000 +0100
--- xstream-1.4.21/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDomDriver.java 2024-11-08 07:05:32.033799868 +0100
+++ xstream-1.4.21/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDomDriver.java 1970-01-01 01:00:00.000000000 +0100
@@ -1,53 +0,0 @@
-/*
- * Copyright (C) 2021 XStream Committers.
@@ -115,8 +115,8 @@
- return new MXParser();
- }
-}
--- xstream-1.4.18/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDriver.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDriver.java 1970-01-01 01:00:00.000000000 +0100
--- xstream-1.4.21/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDriver.java 2024-11-08 07:05:32.033799868 +0100
+++ xstream-1.4.21/xstream/src/java/com/thoughtworks/xstream/io/xml/MXParserDriver.java 1970-01-01 01:00:00.000000000 +0100
@@ -1,55 +0,0 @@
-/*
- * Copyright (C) 2021 XStream Committers.
@@ -173,18 +173,18 @@
- return new MXParser();
- }
-}
--- xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/binary/BinaryStreamTest.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/binary/BinaryStreamTest.java 2021-09-28 07:43:49.593498733 +0200
--- xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/binary/BinaryStreamTest.java 2024-11-08 07:05:32.040466583 +0100
+++ xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/binary/BinaryStreamTest.java 2024-11-08 07:06:51.067688822 +0100
@@ -16,7 +16,7 @@
import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
import com.thoughtworks.xstream.io.copy.HierarchicalStreamCopier;
import com.thoughtworks.xstream.io.xml.AbstractXMLReaderTest;
-import com.thoughtworks.xstream.io.xml.MXParserDriver;
+import com.thoughtworks.xstream.io.xml.Xpp3Driver;
import com.thoughtworks.xstream.security.InputManipulationException;
import java.io.ByteArrayOutputStream;
import java.io.StringReader;
@@ -34,7 +34,7 @@
@@ -36,7 +36,7 @@
protected HierarchicalStreamReader createReader(String xml) throws Exception {
// Transmogrify XML input into binary format.
HierarchicalStreamReader xmlReader =
@@ -193,8 +193,8 @@
ByteArrayOutputStream buffer = new ByteArrayOutputStream();
HierarchicalStreamWriter binaryWriter = new BinaryStreamWriter(buffer);
--- xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/copy/HierarchicalStreamCopierTest.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/copy/HierarchicalStreamCopierTest.java 2021-09-28 07:43:49.593498733 +0200
--- xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/copy/HierarchicalStreamCopierTest.java 2024-11-08 07:05:32.040466583 +0100
+++ xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/copy/HierarchicalStreamCopierTest.java 2024-11-08 07:05:44.177219055 +0100
@@ -16,7 +16,7 @@
import com.thoughtworks.xstream.io.HierarchicalStreamWriter;
import com.thoughtworks.xstream.io.xml.AbstractXMLReaderTest;
@@ -213,8 +213,8 @@
StringWriter buffer = new StringWriter();
HierarchicalStreamWriter destinationWriter = new CompactWriter(buffer);
--- xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/DriverEndToEndTestSuite.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/DriverEndToEndTestSuite.java 2021-09-28 07:43:49.593498733 +0200
--- xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/DriverEndToEndTestSuite.java 2024-11-08 07:05:32.043799940 +0100
+++ xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/DriverEndToEndTestSuite.java 2024-11-08 07:05:44.177219055 +0100
@@ -27,8 +27,6 @@
import com.thoughtworks.xstream.io.xml.JDomDriver;
import com.thoughtworks.xstream.io.xml.KXml2DomDriver;
@@ -233,8 +233,8 @@
addDriverTest(new Xpp3DomDriver());
addDriverTest(new Xpp3Driver());
addDriverTest(new XppDomDriver());
--- xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/xml/MXParserReaderTest.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream/src/test/com/thoughtworks/xstream/io/xml/MXParserReaderTest.java 1970-01-01 01:00:00.000000000 +0100
--- xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/xml/MXParserReaderTest.java 2024-11-08 07:05:32.043799940 +0100
+++ xstream-1.4.21/xstream/src/test/com/thoughtworks/xstream/io/xml/MXParserReaderTest.java 1970-01-01 01:00:00.000000000 +0100
@@ -1,41 +0,0 @@
-/*
- * Copyright (C) 2021 XStream Committers.
@@ -277,9 +277,9 @@
-
- // inherits tests from superclass
-}
--- xstream-1.4.18/xstream-distribution/src/content/changes.html 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream-distribution/src/content/changes.html 2021-09-28 07:43:49.597498756 +0200
@@ -122,12 +122,6 @@
--- xstream-1.4.21/xstream-distribution/src/content/changes.html 2024-11-08 07:05:32.023799796 +0100
+++ xstream-1.4.21/xstream-distribution/src/content/changes.html 2024-11-08 07:05:44.177219055 +0100
@@ -234,12 +234,6 @@
<li><a href="CVE-2021-21351.html">CVE-2021-21351</a></li>
</ul>
@@ -292,8 +292,8 @@
<h2>Minor changes</h2>
<ul>
--- xstream-1.4.18/xstream-distribution/src/content/download.html 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream-distribution/src/content/download.html 2021-09-28 07:43:49.597498756 +0200
--- xstream-1.4.21/xstream-distribution/src/content/download.html 2024-11-08 07:05:32.023799796 +0100
+++ xstream-1.4.21/xstream-distribution/src/content/download.html 2024-11-08 07:05:44.177219055 +0100
@@ -55,14 +55,11 @@
<h1 id="optional-deps">Optional Dependencies</h1>
@@ -325,8 +325,8 @@
</ul>
</li>
</ul>
--- xstream-1.4.18/xstream-jmh/pom.xml 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream-jmh/pom.xml 2021-09-28 07:43:49.597498756 +0200
--- xstream-1.4.21/xstream-jmh/pom.xml 2024-11-08 07:05:32.027133154 +0100
+++ xstream-1.4.21/xstream-jmh/pom.xml 2024-11-08 07:05:44.177219055 +0100
@@ -175,13 +175,13 @@
</dependency>
<!-- parser -->
@@ -344,8 +344,8 @@
<scope>runtime</scope>
</dependency>
<dependency>
--- xstream-1.4.18/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ConverterTypeBenchmark.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ConverterTypeBenchmark.java 2021-09-28 07:43:49.597498756 +0200
--- xstream-1.4.21/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ConverterTypeBenchmark.java 2024-11-08 07:05:32.027133154 +0100
+++ xstream-1.4.21/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ConverterTypeBenchmark.java 2024-11-08 07:05:44.180552412 +0100
@@ -37,7 +37,7 @@
import com.thoughtworks.xstream.converters.reflection.ReflectionConverter;
import com.thoughtworks.xstream.io.HierarchicalStreamReader;
@@ -364,9 +364,9 @@
xstream.addPermission(NoTypePermission.NONE);
xstream.addPermission(ArrayTypePermission.ARRAYS);
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
--- xstream-1.4.18/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ParserBenchmark.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ParserBenchmark.java 2021-09-28 07:43:49.597498756 +0200
@@ -44,7 +44,6 @@
--- xstream-1.4.21/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ParserBenchmark.java 2024-11-08 07:05:32.027133154 +0100
+++ xstream-1.4.21/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/ParserBenchmark.java 2024-11-08 07:05:44.180552412 +0100
@@ -48,7 +48,6 @@
import com.thoughtworks.xstream.io.xml.JDom2Driver;
import com.thoughtworks.xstream.io.xml.JDomDriver;
import com.thoughtworks.xstream.io.xml.KXml2Driver;
@@ -374,7 +374,7 @@
import com.thoughtworks.xstream.io.xml.PrettyPrintWriter;
import com.thoughtworks.xstream.io.xml.StandardStaxDriver;
import com.thoughtworks.xstream.io.xml.WstxDriver;
@@ -78,12 +77,6 @@
@@ -86,12 +85,6 @@
*/
public enum DriverFactory {
/**
@@ -387,8 +387,8 @@
* Factory for the {@link Xpp3Driver}.
*
* @since 1.4.9
--- xstream-1.4.18/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/StringConverterBenchmark.java 2021-08-22 13:58:10.000000000 +0200
+++ xstream-1.4.18/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/StringConverterBenchmark.java 2021-09-28 07:43:49.597498756 +0200
--- xstream-1.4.21/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/StringConverterBenchmark.java 2024-11-08 07:05:32.027133154 +0100
+++ xstream-1.4.21/xstream-jmh/src/java/com/thoughtworks/xstream/benchmark/jmh/StringConverterBenchmark.java 2024-11-08 07:05:44.180552412 +0100
@@ -37,7 +37,6 @@
import com.thoughtworks.xstream.converters.basic.AbstractSingleValueConverter;
import com.thoughtworks.xstream.core.util.WeakCache;

View File

@@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:3e2aad11ed25f53b6c128b5696638bdddbc2ff8ed099718ffa428bb2b865af05
size 1273170

View File

@@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:2fc18347d4d3f3aa08d3619e86fff9a789239a429a5106459f9226080338574c
size 1283669

View File

@@ -1,3 +1,51 @@
-------------------------------------------------------------------
Fri Nov 8 06:19:17 UTC 2024 - Fridrich Strba <fstrba@suse.com>
- Upgrade to 1.4.21
* Security fixes
+ This maintenance release addresses the security vulnerability
CVE-2024-47072 (bsc#1233085), when using the BinaryDriver to
unmarshal a manipulated input stream causing a Denial of
Service due to a stack overflow.
* Major changes
+ #350: Optimize memory allocation
+ Add a converter for the WeakHashMap which does not write any
elements of the map. Avoids also access to the ReentrantLock
contained in the WeakHashMap since Java 19.
* Minor changes
+ #335: Allow PrettyPrintWriter to replace invalid XML
characters when not running in quirks mode
+ #331, #326: Fix handling of empty
java.util.concurrent.atomic.AtomicReference
+ #334: Fix remaining buffer size calculation in QuickWriter
+ #342: Optimize internal handling of children in DomReader
avoiding O(n^2) access times for siblings
+ #349: Fix support of lambda objects for Java 21 and above
+ #359: Add KEYS file with public keys to verify signed
artifacts.
+ Detect input manipulation in
c.t.x.io.binary.BinaryStreamReader.
+ Use Jettison 1.5.4 by default for Java Runtimes version 8 or
higher.
* API changes
+ Added constant
c.t.x.io.xml.PrettyPrintWriter.XML_1_0_REPLACEMENT.
+ Added constant
c.t.x.io.xml.PrettyPrintWriter.XML_1_1_REPLACEMENT.
+ Added c.t.x.converters.collections.WeakHashMapConverter.
+ Protected field fieldsToOmit of
c.t.x.mapper.ElementIgnoringMapper set to private.
+ Protected field unknownElementsToIgnore of
c.t.x.mapper.ElementIgnoringMapper set to private.
* Stream compatibility
+ The WeakHashMaps, that have been written with previous
versions of XStream, can still be deserialized.
- Build against the stax:stax and stax:stax-api artifact
and without hibernate unconditionally
- Modified patch:
* Revert-MXParser-changes.patch
+ rediff
-------------------------------------------------------------------
Tue Feb 20 13:24:30 UTC 2024 - Fridrich Strba <fstrba@suse.com>

View File

@@ -17,10 +17,8 @@
#
%bcond_with hibernate
%bcond_with stax
Name: xstream
Version: 1.4.20
Version: 1.4.21
Release: 0
Summary: Java XML serialization library
License: BSD-3-Clause
@@ -32,7 +30,8 @@ BuildRequires: fdupes
BuildRequires: java-devel >= 1.8
BuildRequires: maven-local
BuildRequires: unzip
BuildRequires: mvn(cglib:cglib)
BuildRequires: mvn(cglib:cglib-nodep)
BuildRequires: mvn(com.fasterxml.woodstox:woodstox-core)
BuildRequires: mvn(dom4j:dom4j)
BuildRequires: mvn(javax.activation:activation)
BuildRequires: mvn(javax.xml.bind:jaxb-api)
@@ -43,21 +42,14 @@ BuildRequires: mvn(org.apache.maven.plugins:maven-antrun-plugin)
BuildRequires: mvn(org.apache.maven.plugins:maven-enforcer-plugin)
BuildRequires: mvn(org.codehaus.jettison:jettison)
BuildRequires: mvn(org.codehaus.mojo:build-helper-maven-plugin)
BuildRequires: mvn(org.codehaus.woodstox:woodstox-core-asl)
BuildRequires: mvn(org.jdom:jdom)
BuildRequires: mvn(org.jdom:jdom2)
BuildRequires: mvn(stax:stax)
BuildRequires: mvn(stax:stax-api)
BuildRequires: mvn(xom:xom)
BuildRequires: mvn(xpp3:xpp3)
BuildRequires: mvn(xpp3:xpp3_min)
BuildArch: noarch
%if %{with hibernate}
BuildRequires: mvn(org.hibernate:hibernate-core)
BuildRequires: mvn(org.hibernate:hibernate-envers)
%endif
%if %{with stax}
BuildRequires: mvn(stax:stax)
BuildRequires: mvn(stax:stax-api)
%endif
%description
XStream is a simple library to serialize objects to XML
@@ -86,16 +78,6 @@ Group: Documentation/HTML
%description javadoc
%{name} API documentation.
%if %{with hibernate}
%package hibernate
Summary: The hibernate module for %{name}
Group: Development/Libraries/Java
Requires: %{name} = %{version}-%{release}
%description hibernate
This package contains the hibernate module for %{name}.
%endif
%package benchmark
Summary: The benchmark module for %{name}
Group: Development/Libraries/Java
@@ -120,69 +102,23 @@ find . -name "*.jar" -print -delete
# Require org.codehaus.xsite:xsite-maven-plugin
%pom_disable_module xstream-distribution
%pom_remove_plugin :xsite-maven-plugin
# missing artifacts:
# org.openjdk.jmh:jmh-core:jar:1.11.1
# org.openjdk.jmh:jmh-generator-annprocess:jar:1.11.1
%pom_disable_module xstream-jmh
%pom_remove_plugin :xsite-maven-plugin
%pom_disable_module xstream-hibernate
# Unwanted
%pom_remove_plugin :maven-source-plugin
%pom_remove_plugin :maven-dependency-plugin
%pom_remove_plugin :maven-eclipse-plugin
%pom_remove_plugin :maven-release-plugin
%pom_xpath_set "pom:dependency[pom:groupId = 'org.codehaus.woodstox' ]/pom:artifactId" woodstox-core-asl
%pom_xpath_set "pom:dependency[pom:groupId = 'org.codehaus.woodstox' ]/pom:artifactId" woodstox-core-asl xstream
%pom_xpath_set "pom:dependency[pom:groupId = 'cglib' ]/pom:artifactId" cglib
%pom_xpath_set "pom:dependency[pom:groupId = 'cglib' ]/pom:artifactId" cglib xstream
# Require unavailable proxytoys:proxytoys
%pom_remove_plugin :maven-dependency-plugin xstream
%pom_xpath_set "pom:project/pom:dependencies/pom:dependency[pom:groupId = 'cglib' ]/pom:artifactId" cglib xstream-hibernate
%pom_xpath_inject "pom:project/pom:dependencies/pom:dependency[pom:groupId = 'junit' ]" "<scope>test</scope>" xstream-hibernate
%pom_remove_plugin :maven-dependency-plugin xstream-hibernate
%pom_xpath_inject "pom:project/pom:dependencies/pom:dependency[pom:groupId = 'junit' ]" "<scope>test</scope>" xstream-benchmark
%pom_xpath_remove "pom:project/pom:profiles/pom:profile[pom:id = 'jdk12-ge' ]"
%pom_xpath_inject "pom:project/pom:profiles" "
<profile>
<id>jdk18-ge</id>
<activation>
<jdk>[18,)</jdk>
</activation>
<properties>
<version.java.5>1.8</version.java.5>
<version.java.6>1.8</version.java.6>
<version.java.source>1.8</version.java.source>
<version.java.target>1.8</version.java.target>
</properties>
</profile>
<profile>
<id>jdk12-ge-18</id>
<activation>
<jdk>[12,18)</jdk>
</activation>
<properties>
<version.java.5>1.7</version.java.5>
<version.java.6>1.7</version.java.6>
<version.java.source>1.7</version.java.source>
<version.java.target>1.7</version.java.target>
</properties>
</profile>"
%if %{without hibernate}
%pom_disable_module xstream-hibernate
%endif
%if %{without stax}
%pom_remove_dep -r stax:
rm -f xstream/src/java/com/thoughtworks/xstream/io/xml/BEAStaxDriver.java \
xstream-benchmark/src/java/com/thoughtworks/xstream/tools/benchmark/products/XStreamBEAStax.java
%endif
%pom_remove_plugin :maven-dependency-plugin xstream xstream-hibernate
%{mvn_file} :%{name} %{name}/%{name} %{name}
%{mvn_file} :%{name}-benchmark %{name}/%{name}-benchmark %{name}-benchmark
@@ -192,7 +128,7 @@ rm -f xstream/src/java/com/thoughtworks/xstream/io/xml/BEAStaxDriver.java \
%build
%{mvn_build} -f -s -- \
-Dproject.build.outputTimestamp=$(date -u -d @${SOURCE_DATE_EPOCH:-$(date +%%s)} +%%Y-%%m-%%dT%%H:%%M:%%SZ) \
-Dversion.java.source=8 -Dversion.java.target=8
-Dversion.java.source=8 -Dversion.java.target=8
%install
%mvn_install