Accepting request 1133926 from utilities

- Remove 0001-fix-life-in-zola-serve.patch. Part of 0.18.0 release now.
- Remove cargo_config. Part of vendored tarball now.
- Update to version 0.18.0:
  * update dependencies
  * remove some dummy file
  * fix taxonomies missing lang in sitemap
  * remove code blocks from search index
  * elasticlunr-rs hu language support

OBS-URL: https://build.opensuse.org/request/show/1133926
OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/zola?expand=0&rev=10
This commit is contained in:
2023-12-19 22:15:56 +00:00
committed by Git OBS Bridge
8 changed files with 22 additions and 90 deletions
+12
View File
@@ -1,3 +1,15 @@
-------------------------------------------------------------------
Tue Dec 19 00:19:31 UTC 2023 - Soc Virnyl Estela <uncomfy+openbuildservice@uncomfyhalomacro.pl>
- Remove 0001-fix-life-in-zola-serve.patch. Part of 0.18.0 release now.
- Remove cargo_config. Part of vendored tarball now.
- Update to version 0.18.0:
* update dependencies
* remove some dummy file
* fix taxonomies missing lang in sitemap
* remove code blocks from search index
* elasticlunr-rs hu language support
-------------------------------------------------------------------
Tue Aug 15 04:00:16 UTC 2023 - Soc Virnyl Estela <socvirnyl.estela@gmail.com>
+2 -6
View File
@@ -17,15 +17,13 @@
Name: zola
Version: 0.17.2
Version: 0.18.0
Release: 0
Summary: Fast static site generator
License: MIT
URL: https://github.com/getzola/zola
Source0: %{name}-%{version}.tar.zst
Source0: https://github.com/getzola/zola/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz
Source1: vendor.tar.zst
Source2: cargo_config
Patch1: https://github.com/getzola/zola/pull/2258.patch#/0001-fix-life-in-zola-serve.patch
BuildRequires: c++_compiler
BuildRequires: c_compiler
BuildRequires: cargo-packaging
@@ -42,8 +40,6 @@ a strongly defined, highly compatible specification of Markdown.
%prep
%autosetup -a1 -p1
mkdir .cargo
cp %{SOURCE2} .cargo/config
%package fish-completion
Summary: Fish Completion for %{name}
+3 -20
View File
@@ -1,27 +1,10 @@
<services>
<service mode="manual" name="obs_scm">
<param name="url">https://github.com/getzola/zola</param>
<param name="versionformat">@PARENT_TAG@</param>
<param name="scm">git</param>
<param name="revision">7c6bdc1</param>
<param name="versionrewrite-pattern">v(.*)</param>
<param name="versionrewrite-replacement">\1</param>
<param name="changesgenerate">enable</param>
<param name="changesauthor">socvirnyl.estela@gmail.com</param>
</service>
<service mode="manual" name="tar" />
<service mode="manual" name="recompress">
<param name="file">*.tar</param>
<param name="compression">zstd</param>
</service>
<service mode="manual" name="set_version"/>
<service mode="manual" name="download_files" />
<service name="cargo_vendor" mode="manual">
<param name="srcdir">zola</param>
<param name="src">zola*.tar.gz</param>
<param name="compression">zst</param>
<param name="update">true</param>
</service>
<service name="cargo_audit" mode="manual">
<param name="srcdir">zola</param>
</service>
<service name="cargo_audit" mode="manual" />
</services>
-54
View File
@@ -1,54 +0,0 @@
From 8d514e8bebeaa73393450fc386c01aec35bfe8a4 Mon Sep 17 00:00:00 2001
From: adeadfed <maksym.vatsyk17@gmail.com>
Date: Mon, 24 Jul 2023 18:41:23 +0200
Subject: [PATCH 1/2] use fs canonicalize to prevent path traversal
---
src/cmd/serve.rs | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/src/cmd/serve.rs b/src/cmd/serve.rs
index 52b1d585b..e102e90d0 100644
--- a/src/cmd/serve.rs
+++ b/src/cmd/serve.rs
@@ -116,6 +116,14 @@ async fn handle_request(req: Request<Body>, mut root: PathBuf) -> Result<Respons
// otherwise `PathBuf` will interpret it as an absolute path
root.push(&decoded[1..]);
+ // Resolve the root + user supplied path into the absolute path
+ // this should hopefully remove any path traversals
+ // if we fail to resolve path, we should return 404
+ root = match tokio::fs::canonicalize(&root).await {
+ Ok(d) => d,
+ Err(_) => return Ok(not_found())
+ };
+
// Ensure we are only looking for things in our public folder
if !root.starts_with(original_root) {
return Ok(not_found());
From 219fe9bed1d2aae5c6b57b2017cce8956ce62cf7 Mon Sep 17 00:00:00 2001
From: Maksym Vatsyk <maksym.vatsyk17@gmail.com>
Date: Mon, 24 Jul 2023 23:38:47 +0200
Subject: [PATCH 2/2] fix cargo fmt
---
src/cmd/serve.rs | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/src/cmd/serve.rs b/src/cmd/serve.rs
index e102e90d0..a6e906cb0 100644
--- a/src/cmd/serve.rs
+++ b/src/cmd/serve.rs
@@ -121,9 +121,9 @@ async fn handle_request(req: Request<Body>, mut root: PathBuf) -> Result<Respons
// if we fail to resolve path, we should return 404
root = match tokio::fs::canonicalize(&root).await {
Ok(d) => d,
- Err(_) => return Ok(not_found())
+ Err(_) => return Ok(not_found()),
};
-
+
// Ensure we are only looking for things in our public folder
if !root.starts_with(original_root) {
return Ok(not_found());
-5
View File
@@ -1,5 +0,0 @@
[source.crates-io]
replace-with = "vendored-sources"
[source.vendored-sources]
directory = "vendor"
+2 -2
View File
@@ -1,3 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:bdfdce363553fc09ee78af6770a31fc16262f6285045218a489739014fe42f2d
size 83554421
oid sha256:7ef3a374b83fd65c401d5e0700a1d9320daf6319466bc4095133b47e9b7c63b2
size 63545535
-3
View File
@@ -1,3 +0,0 @@
version https://git-lfs.github.com/spec/v1
oid sha256:f75dcbaf82a4b2e2d3d3f2f97ab6ec16cd2b22e5c05033902603cd2c4e55e725
size 20273129
+3
View File
@@ -0,0 +1,3 @@
version https://git-lfs.github.com/spec/v1
oid sha256:c0e1711a68bc005c2e0ecc76a468f3459739c9e54af34850cb725d04391e19b5
size 28510501