Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package obs-service-tar_scm for
openSUSE:Factory checked in at 2026-07-06 12:27:22
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/obs-service-tar_scm (Old)
and /work/SRC/openSUSE:Factory/.obs-service-tar_scm.new.1982 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "obs-service-tar_scm"
Mon Jul 6 12:27:22 2026 rev:92 rq:1363017 version:0.12.4
Changes:
--------
--- /work/SRC/openSUSE:Factory/obs-service-tar_scm/obs-service-tar_scm.changes
2026-05-20 15:24:23.185805987 +0200
+++
/work/SRC/openSUSE:Factory/.obs-service-tar_scm.new.1982/obs-service-tar_scm.changes
2026-07-06 12:27:42.337758182 +0200
@@ -1,0 +2,8 @@
+Wed Jul 01 14:59:47 UTC 2026 - Frank Schreiner <[email protected]>
+
+- Update to version 0.12.4:
+ * improve option sanitising revision/url
+ * Fixes: boo#1269546
+ * Fixes: CVE-2026-56004
+
+-------------------------------------------------------------------
Old:
----
obs-service-tar_scm-0.12.3.tar.gz
New:
----
obs-service-tar_scm-0.12.4.tar.gz
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ obs-service-tar_scm.spec ++++++
--- /var/tmp/diff_new_pack.4urVi7/_old 2026-07-06 12:27:43.357793560 +0200
+++ /var/tmp/diff_new_pack.4urVi7/_new 2026-07-06 12:27:43.357793560 +0200
@@ -122,8 +122,8 @@
%define pkg_name obs-service-tar_scm
Name: %{pkg_name}%{nsuffix}
-%define version_unconverted 0.12.3
-Version: 0.12.3
+%define version_unconverted 0.12.4
+Version: 0.12.4
Release: 0
Summary: An OBS source service: create tar ball from svn/git/hg
License: GPL-2.0-or-later
++++++ PKGBUILD ++++++
--- /var/tmp/diff_new_pack.4urVi7/_old 2026-07-06 12:27:43.401795086 +0200
+++ /var/tmp/diff_new_pack.4urVi7/_new 2026-07-06 12:27:43.405795225 +0200
@@ -1,5 +1,5 @@
pkgname=obs-service-tar_scm
-pkgver=0.12.3
+pkgver=0.12.4
pkgrel=0
pkgdesc="Source Service for the OpenSUSE Build Service (OBS)"
arch=('any')
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.4urVi7/_old 2026-07-06 12:27:43.457797028 +0200
+++ /var/tmp/diff_new_pack.4urVi7/_new 2026-07-06 12:27:43.461797167 +0200
@@ -12,7 +12,7 @@
</service>
<service name="tar_scm">
<param
name="url">https://github.com/openSUSE/obs-service-tar_scm.git</param>
- <param
name="changesrevision">64adb15a175b50be1ff71938251e7e12e846e1ac</param>
+ <param
name="changesrevision">991e3a1f2e87c0b611deefb8d95f38a2a25c42a3</param>
</service>
</servicedata>
(No newline at EOF)
++++++ debian.dsc ++++++
--- /var/tmp/diff_new_pack.4urVi7/_old 2026-07-06 12:27:43.489798138 +0200
+++ /var/tmp/diff_new_pack.4urVi7/_new 2026-07-06 12:27:43.493798277 +0200
@@ -1,6 +1,6 @@
Format: 1.0
Source: obs-service-tar-scm
-Version: 0.12.3
+Version: 0.12.4
Provides: obs-service-obs_scm, obs-service-tar, obs-service-gbp
Binary: obs-service-tar_scm
Maintainer: Adrian Schroeter <[email protected]>
++++++ obs-service-tar_scm-0.12.3.tar.gz -> obs-service-tar_scm-0.12.4.tar.gz
++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/TarSCM/cli.py
new/obs-service-tar_scm-0.12.4/TarSCM/cli.py
--- old/obs-service-tar_scm-0.12.3/TarSCM/cli.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/TarSCM/cli.py 2026-07-01
16:51:23.000000000 +0200
@@ -6,6 +6,7 @@
import locale
import subprocess
import logging
+import re
def contains_dotdot(files):
@@ -319,4 +320,12 @@
os.environ["LANG"] = use_locale
os.environ["LANGUAGE"] = use_locale
+ # Filter for suspicious revision formats
+ # Allowed: `v1.1-2`
+ # Not Allowed:
+ # `-1.1.2`
+ # `1.1 2`
+ if args.revision and re.search(r'\s', args.revision):
+ raise SystemExit(f"option revision ({args.revision}) contains
forbidden characters")
+
return args
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/TarSCM/scm/base.py
new/obs-service-tar_scm-0.12.4/TarSCM/scm/base.py
--- old/obs-service-tar_scm-0.12.3/TarSCM/scm/base.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/TarSCM/scm/base.py 2026-07-01
16:51:23.000000000 +0200
@@ -9,6 +9,8 @@
import subprocess
import glob
+from pathlib import Path
+
from TarSCM.helpers import Helpers
from TarSCM.changes import Changes
from TarSCM.config import Config
@@ -406,7 +408,7 @@
self.cleanup()
def check_url(self):
- return True
+ pass
def run_and_hide(self, command, wdir, cleanup_dirs=[]):
try:
@@ -419,6 +421,10 @@
raise SystemExit(exc)
def _prepare_gpg_settings(self):
+ infile = Path(self.args.maintainers_asc)
+ if not infile.is_file():
+ raise SystemExit(f"File {infile} does not exist.")
+
logging.debug("preparing gpg settings")
self._backup_gnupghome = os.getenv('GNUPGHOME')
gpgdir = tempfile.mkdtemp()
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/TarSCM/scm/bzr.py
new/obs-service-tar_scm-0.12.4/TarSCM/scm/bzr.py
--- old/obs-service-tar_scm-0.12.3/TarSCM/scm/bzr.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/TarSCM/scm/bzr.py 2026-07-01
16:51:23.000000000 +0200
@@ -3,6 +3,7 @@
import os
import dateutil.parser
from TarSCM.scm.base import Scm
+from TarSCM.exceptions import OptionsError
class Bzr(Scm):
@@ -71,5 +72,4 @@
def check_url(self):
"""check if url is a remote url"""
if not re.match("^((a?ftp|bzr|https?)://|lp:)", self.url):
- return False
- return True
+ raise OptionsError(f"URL does not match allowed scheme:
{self.url}")
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/TarSCM/scm/git.py
new/obs-service-tar_scm-0.12.4/TarSCM/scm/git.py
--- old/obs-service-tar_scm-0.12.3/TarSCM/scm/git.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/TarSCM/scm/git.py 2026-07-01
16:51:23.000000000 +0200
@@ -5,7 +5,7 @@
import shutil
from TarSCM.scm.base import Scm
-from TarSCM.exceptions import GitError
+from TarSCM.exceptions import GitError, OptionsError
def search_tags(comment, limit=None):
@@ -489,19 +489,13 @@
def check_url(self):
"""check if url is a remote url"""
- # no local path allowed
- if re.match('^file:', self.url):
- return False
-
- if '://' in self.url:
- return bool(re.match("^(https?|ftps?|git|ssh)://", self.url))
-
- # e.g. [email protected]:path/to/repo
- if re.match('^[^/]+:', self.url):
- return True
+ if re.findall(r"\s", self.url):
+ raise OptionsError(f"URL contains space characters: {self.url}")
+
+ pat = r"^(https?|ftps?|git|ssh)://"
+ if not re.match(pat, self.url):
+ raise OptionsError(f"Invalid url scheme ({pat}): {self.url}")
- # Deny by default, might be local path
- return False
def find_latest_signed_commit(self, commit):
if not commit:
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/TarSCM/scm/hg.py
new/obs-service-tar_scm-0.12.4/TarSCM/scm/hg.py
--- old/obs-service-tar_scm-0.12.3/TarSCM/scm/hg.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/TarSCM/scm/hg.py 2026-07-01
16:51:23.000000000 +0200
@@ -5,6 +5,7 @@
import shutil
import logging
from TarSCM.scm.base import Scm
+from TarSCM.exceptions import OptionsError
class Hg(Scm):
@@ -49,7 +50,8 @@
if self.revision is None:
self.revision = 'tip'
- cmd = self._get_scm_cmd() + ['update', self.revision]
+ # prevent option injection by adding `--`
+ cmd = self._get_scm_cmd() + ['update', '--', self.revision]
rcode, _ = self.helpers.run_cmd(cmd,
cwd=self.clone_dir,
interactive=sys.stdout.isatty())
@@ -142,5 +144,6 @@
def check_url(self):
"""check if url is a remote url"""
if not re.match("^https?://", self.url):
- return False
- return True
+ raise OptionsError(f"Invalid url scheme (try http/https):
{self.url}")
+ if re.findall(r"\s", self.url):
+ raise OptionsError(f"Found space character in url: {self.url}")
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/TarSCM/scm/svn.py
new/obs-service-tar_scm-0.12.4/TarSCM/scm/svn.py
--- old/obs-service-tar_scm-0.12.3/TarSCM/scm/svn.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/TarSCM/scm/svn.py 2026-07-01
16:51:23.000000000 +0200
@@ -9,6 +9,7 @@
import dateutil.parser
from TarSCM.scm.base import Scm
+from TarSCM.exceptions import OptionsError
ENCODING_RE = re.compile(r".*("
"Can't convert string from '.*' to native encoding:"
@@ -239,5 +240,4 @@
def check_url(self):
"""check if url is a remote url"""
if not re.match("^(https?|svn)://", self.url):
- return False
- return True
+ raise OptionsError(f"Invalid url scheme (valid http/https/svn):
{self.url}")
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/TarSCM/tasks.py
new/obs-service-tar_scm-0.12.4/TarSCM/tasks.py
--- old/obs-service-tar_scm-0.12.3/TarSCM/tasks.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/TarSCM/tasks.py 2026-07-01
16:51:23.000000000 +0200
@@ -212,8 +212,8 @@
self.scm_object = scm_object = scm_class(args, self)
tmode = bool(os.getenv('TAR_SCM_TESTMODE'))
- if not tmode and not scm_object.check_url():
- sys.exit("--url does not match remote repository")
+ if not tmode:
+ scm_object.check_url()
try:
scm_object.check_scm()
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/tests/cli.py
new/obs-service-tar_scm-0.12.4/tests/cli.py
--- old/obs-service-tar_scm-0.12.3/tests/cli.py 1970-01-01 01:00:00.000000000
+0100
+++ new/obs-service-tar_scm-0.12.4/tests/cli.py 2026-07-01 16:51:23.000000000
+0200
@@ -0,0 +1,39 @@
+from __future__ import print_function
+
+import unittest
+import re
+import argparse
+
+from tar_scm import TarSCM
+
+
+class CliTestCases(unittest.TestCase):
+ def setUp(self):
+ self.cli = TarSCM.Cli()
+
+ def test_parse_args_valid_revision(self):
+
+ valid_rev = ['1.2.3', 'v1.2.3', '1.2-3', '@PARENT_TAG@']
+ for rev in valid_rev:
+ self.cli.parse_args([
+ '--outdir', '.',
+ '--scm', 'git',
+ '--revision', rev
+ ])
+
+ def test_parse_args_invalid_revision(self):
+ for rev in ['1.2.3 --config', '1.2 3']:
+ with self.assertRaisesRegex(SystemExit, r"option revision \(.*\)
contains forbidden characters"):
+ self.cli.parse_args([
+ '--outdir', '.',
+ '--scm', 'git',
+ '--revision', rev
+ ])
+
+ for rev in ['1.2.3 --config', '-p123', '1.2 -p']:
+ with self.assertRaisesRegex(SystemExit, r"2"):
+ self.cli.parse_args([
+ '--outdir', '.',
+ '--scm', 'git',
+ '--revision', rev
+ ])
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/tests/test.py
new/obs-service-tar_scm-0.12.4/tests/test.py
--- old/obs-service-tar_scm-0.12.3/tests/test.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/tests/test.py 2026-07-01
16:51:23.000000000 +0200
@@ -21,6 +21,7 @@
from tests.tasks import TasksTestCases
from tests.scm import SCMBaseTestCases
from tests.tartests import TarTestCases
+from tests.cli import CliTestCases
from tests.archiveobscpiotestcases import ArchiveOBSCpioTestCases
@@ -43,7 +44,8 @@
SCMBaseTestCases,
GitTests,
SvnTests,
- TarTestCases
+ TarTestCases,
+ CliTestCases
]
# quite ugly to remove them here
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/obs-service-tar_scm-0.12.3/tests/unittestcases.py
new/obs-service-tar_scm-0.12.4/tests/unittestcases.py
--- old/obs-service-tar_scm-0.12.3/tests/unittestcases.py 2026-05-19
13:33:30.000000000 +0200
+++ new/obs-service-tar_scm-0.12.4/tests/unittestcases.py 2026-07-01
16:51:23.000000000 +0200
@@ -23,6 +23,7 @@
from TarSCM.scm.svn import Svn
from TarSCM.scm.hg import Hg
from TarSCM.scm.bzr import Bzr
+from TarSCM.exceptions import OptionsError
# pylint: disable=duplicate-code
@@ -248,7 +249,7 @@
for tca in tc_arr:
for url in tca['urls']:
tca['obj'].url = url
- self.assertTrue(tca['obj'].check_url())
+ tca['obj'].check_url()
def test_check_url_invalid(self):
invalid = [
@@ -265,6 +266,7 @@
'/lala/nana',
'/tmp/[email protected]:my/local/path'
'/tmp/example.com:my/local/path'
+ 'local/relative/path'
]
scms = [
@@ -278,7 +280,11 @@
for url in invalid:
print("%r %s" % (scm, url))
scm.url = url
- self.assertFalse(scm.check_url())
+ self.assertRaisesRegex(
+ OptionsError,
+ re.compile(r"Invalid url scheme .*"),
+ scm.check_url()
+ )
def test_scm_tar_invalid_params(self):
tc_name = inspect.stack()[0][3]
