Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package squid for openSUSE:Factory checked in at 2026-09-10 11:46:32 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/squid (Old) and /work/SRC/openSUSE:Factory/.squid.new.1265 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "squid" Thu Sep 10 11:46:32 2026 rev:127 rq:1376418 version:7.7 Changes: -------- --- /work/SRC/openSUSE:Factory/squid/squid.changes 2026-06-19 17:22:59.425407307 +0200 +++ /work/SRC/openSUSE:Factory/.squid.new.1265/squid.changes 2026-09-10 11:46:58.653467144 +0200 @@ -1,0 +2,13 @@ +Tue Aug 25 07:50:28 UTC 2026 - Martin Pluskal <[email protected]> + +- Update to 7.7: + * FTP: Reject commands with parameters containing CR + * FTP: Do not send commands with embedded CRs or LFs + * Protect several base64 encoding buffers + * Honor directive parameters that follow a quoted filename + reference + * Assorted build optimisations and code cleanups +- Modernise spec file with spec-cleaner and drop the unused + fdupes build dependency + +------------------------------------------------------------------- Old: ---- squid-7.6.tar.xz squid-7.6.tar.xz.asc New: ---- squid-7.7.tar.xz squid-7.7.tar.xz.asc ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ squid.spec ++++++ --- /var/tmp/diff_new_pack.yBPOMg/_old 2026-09-10 11:46:59.748513051 +0200 +++ /var/tmp/diff_new_pack.yBPOMg/_new 2026-09-10 11:46:59.749513093 +0200 @@ -24,14 +24,13 @@ %define squidhelperdir %{_sbindir} %endif Name: squid -Version: 7.6 +Version: 7.7 Release: 0 Summary: Caching and forwarding HTTP web proxy License: GPL-2.0-or-later -Group: Productivity/Networking/Web/Proxy -URL: http://www.squid-cache.org -Source0: https://github.com/squid-cache/squid/releases/download/SQUID_7_6/squid-7.6.tar.xz -Source1: https://github.com/squid-cache/squid/releases/download/SQUID_7_6/squid-7.6.tar.xz.asc +URL: https://www.squid-cache.org +Source0: https://github.com/squid-cache/squid/releases/download/SQUID_7_7/squid-7.7.tar.xz +Source1: https://github.com/squid-cache/squid/releases/download/SQUID_7_7/squid-7.7.tar.xz.asc Source5: pam.squid Source6: unsquid.pl Source7: %{name}.logrotate @@ -47,15 +46,7 @@ Source17: tmpfilesdir.squid.conf Patch1: missing_installs.patch Patch3: harden_squid.service.patch -BuildRequires: cppunit-devel BuildRequires: expat -BuildRequires: fdupes -%if 0%{?suse_version} < 1590 -BuildRequires: gcc11-c++ -%else -BuildRequires: gcc-c++ -%endif -BuildRequires: libcap-devel BuildRequires: libtool BuildRequires: openldap2-devel BuildRequires: openssl-devel @@ -63,9 +54,11 @@ BuildRequires: pkgconfig BuildRequires: samba-winbind BuildRequires: sharutils +BuildRequires: pkgconfig(cppunit) BuildRequires: pkgconfig(expat) BuildRequires: pkgconfig(gssrpc) BuildRequires: pkgconfig(krb5) +BuildRequires: pkgconfig(libcap) BuildRequires: pkgconfig(libsasl2) BuildRequires: pkgconfig(libxml-2.0) BuildRequires: pkgconfig(nettle) @@ -74,6 +67,11 @@ Recommends: logrotate Provides: http_proxy %{?systemd_ordering} +%if 0%{?suse_version} < 1590 +BuildRequires: gcc11-c++ +%else +BuildRequires: gcc-c++ +%endif %if 0%{?suse_version} <= 1500 # due to package rename # Wed Aug 15 17:40:30 UTC 2012 @@ -89,7 +87,7 @@ Requires(pre): shadow %endif %if 0%{?suse_version} >= 1330 && 0%{?suse_version} < 1599 -BuildRequires: libnsl-devel +BuildRequires: pkgconfig(libnsl) %endif %description @@ -166,7 +164,7 @@ mkdir src/icmp/tests #mkdir tools/squidclient/tests #mkdir tools/sysvinit/tests tools/tests -make %{?_smp_mflags} +%make_build %if 0%{?suse_version} >= 1500 %sysusers_generate_pre %{SOURCE12} squid %endif @@ -235,11 +233,11 @@ %check # Fails in chroot environment -make check %{?_smp_mflags} +%make_build check %pretrans -p <lua> -- Remove symlink that is has become a directory -path = "%_datadir/squid/errors/es-mx" +path = "%{_datadir}/squid/errors/es-mx" st = posix.stat(path) if st and st.type == "link" then os.remove(path) @@ -248,7 +246,6 @@ %if 0%{?suse_version} >= 1500 %pre -f squid.pre %else - %pre # we need this group for /usr/sbin/pinger getent group %{name} >/dev/null || %{_sbindir}/groupadd -g 31 -r %{name} @@ -269,6 +266,7 @@ fi %endif %service_add_pre %{name}.service + %if 0%{?suse_version} > 1500 # Prepare for migration to /usr/etc; save any old .rpmsave for i in logrotate.d/%{name} pam.d/%{name} ; do ++++++ _scmsync.obsinfo ++++++ --- /var/tmp/diff_new_pack.yBPOMg/_old 2026-09-10 11:46:59.802515315 +0200 +++ /var/tmp/diff_new_pack.yBPOMg/_new 2026-09-10 11:46:59.806515483 +0200 @@ -1,5 +1,5 @@ -mtime: 1781798856 -commit: 2289f0c4b6c461d593b0447c9e3afc7e772c96f8d340b1a16ad28c8c4cd59df0 +mtime: 1787843877 +commit: 1ef6ec52cb4bb6e21891ea166e94682dd8aa51be819dc23641597a775172d971 url: https://src.opensuse.org/adamm/squid revision: factory ++++++ build.specials.obscpio ++++++ ++++++ build.specials.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/.gitignore new/.gitignore --- old/.gitignore 1970-01-01 01:00:00.000000000 +0100 +++ new/.gitignore 2026-08-27 17:17:57.000000000 +0200 @@ -0,0 +1,4 @@ +*.obscpio +*.osc +_build.* +.pbuild ++++++ squid-7.6.tar.xz -> squid-7.7.tar.xz ++++++ ++++ 1709 lines of diff (skipped) ++++ retrying with extended exclude list diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/ChangeLog new/squid-7.7/ChangeLog --- old/squid-7.6/ChangeLog 2026-06-08 09:37:04.000000000 +0200 +++ new/squid-7.7/ChangeLog 2026-08-24 08:36:52.000000000 +0200 @@ -1,3 +1,12 @@ +Changes in squid-7.7 (17 Aug 2026): + + - Protect several base64 encoding buffers + - Honor directive parameters after a quoted filename reference + - FTP: Reject commands with parameters containing CR + - FTP: Do not send commands with embedded CRs or LFs + - ... and some build optimizations + - ... and some cleanups + Changes in squid-7.6 (08 Jun 2026): - HTTP/1.1: Transfer-Encoding:identity is prohibited diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/RELEASENOTES.html new/squid-7.7/RELEASENOTES.html --- old/squid-7.6/RELEASENOTES.html 2026-06-08 10:37:47.000000000 +0200 +++ new/squid-7.7/RELEASENOTES.html 2026-08-24 09:08:46.000000000 +0200 @@ -3,10 +3,10 @@ <HEAD> <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.83"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> - <TITLE>Squid 7.6 release notes</TITLE> + <TITLE>Squid 7.7 release notes</TITLE> </HEAD> <BODY> -<H1>Squid 7.6 release notes</H1> +<H1>Squid 7.7 release notes</H1> <H2>Squid Developers</H2> <P> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/configure.ac new/squid-7.7/configure.ac --- old/squid-7.6/configure.ac 2026-06-08 10:34:42.000000000 +0200 +++ new/squid-7.7/configure.ac 2026-08-24 09:05:33.000000000 +0200 @@ -5,7 +5,7 @@ ## Please see the COPYING and CONTRIBUTORS files for details. ## -AC_INIT([Squid Web Proxy],[7.6],[https://bugs.squid-cache.org/],[squid]) +AC_INIT([Squid Web Proxy],[7.7],[https://bugs.squid-cache.org/],[squid]) AC_PREREQ(2.61) AC_CONFIG_HEADERS([include/autoconf.h]) AC_CONFIG_AUX_DIR(cfgaux) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/doc/release-notes/release-7.html new/squid-7.7/doc/release-notes/release-7.html --- old/squid-7.6/doc/release-notes/release-7.html 2026-06-08 10:37:47.000000000 +0200 +++ new/squid-7.7/doc/release-notes/release-7.html 2026-08-24 09:08:46.000000000 +0200 @@ -3,10 +3,10 @@ <HEAD> <META NAME="GENERATOR" CONTENT="LinuxDoc-Tools 0.9.83"> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> - <TITLE>Squid 7.6 release notes</TITLE> + <TITLE>Squid 7.7 release notes</TITLE> </HEAD> <BODY> -<H1>Squid 7.6 release notes</H1> +<H1>Squid 7.7 release notes</H1> <H2>Squid Developers</H2> <P> diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/errors/Makefile.am new/squid-7.7/errors/Makefile.am --- old/squid-7.6/errors/Makefile.am 2026-04-20 10:41:18.000000000 +0200 +++ new/squid-7.7/errors/Makefile.am 2026-08-17 08:59:38.000000000 +0200 @@ -68,7 +68,7 @@ echo "Done translating $$lang"; \ else \ lang=$(@:.lang=); \ - echo "Translation of $$lang disabled\n"; \ + echo "Translation of $$lang disabled"; \ fi; \ touch $@ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/lib/sspi/sspwin32.cc new/squid-7.7/lib/sspi/sspwin32.cc --- old/squid-7.6/lib/sspi/sspwin32.cc 2026-04-20 10:41:18.000000000 +0200 +++ new/squid-7.7/lib/sspi/sspwin32.cc 2026-08-17 08:59:38.000000000 +0200 @@ -500,6 +500,7 @@ struct base64_encode_ctx ctx; base64_encode_init(&ctx); static char encoded[8192]; + assert(base64_encode_len(cbOut) < sizeof(encoded)); size_t dstLen = base64_encode_update(&ctx, encoded, cbOut, reinterpret_cast<const uint8_t*>(fResult)); assert(dstLen < sizeof(encoded)); dstLen += base64_encode_final(&ctx, encoded+dstLen); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/TestHeaders.am new/squid-7.7/src/TestHeaders.am --- old/squid-7.6/src/TestHeaders.am 2026-04-20 10:41:18.000000000 +0200 +++ new/squid-7.7/src/TestHeaders.am 2026-08-17 08:59:38.000000000 +0200 @@ -20,7 +20,7 @@ .h.hdrtest: @SrcFilePath=`echo $< | $(SED) 's%^$(top_srcdir)/%%'`; \ SrcFileName=`basename $$SrcFilePath`; \ - TargetFileName=tmp$$$$-`basename $@`; \ + TargetFileName="`dirname $$SrcFilePath | $(SED) 's!/!-!g'`-`basename $@`"; \ if test "$(EXCLUDE_FROM_HDR_TESTING)" != "" && echo "$(EXCLUDE_FROM_HDR_TESTING)" | $(TR) ' ' '\n' | $(FGREP) -x -q "$$SrcFileName" ; then \ echo "header-test: skip - $$SrcFilePath"; \ exit 0; \ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/acl/external/SQL_session/ext_sql_session_acl.8 new/squid-7.7/src/acl/external/SQL_session/ext_sql_session_acl.8 --- old/squid-7.6/src/acl/external/SQL_session/ext_sql_session_acl.8 2026-06-08 10:46:28.000000000 +0200 +++ new/squid-7.7/src/acl/external/SQL_session/ext_sql_session_acl.8 2026-08-24 09:17:39.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "EXT_SQL_SESSION_ACL 8" -.TH EXT_SQL_SESSION_ACL 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH EXT_SQL_SESSION_ACL 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/acl/external/delayer/ext_delayer_acl.8 new/squid-7.7/src/acl/external/delayer/ext_delayer_acl.8 --- old/squid-7.6/src/acl/external/delayer/ext_delayer_acl.8 2026-06-08 10:46:25.000000000 +0200 +++ new/squid-7.7/src/acl/external/delayer/ext_delayer_acl.8 2026-08-24 09:17:36.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "EXT_DELAYER_ACL 8" -.TH EXT_DELAYER_ACL 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH EXT_DELAYER_ACL 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/acl/external/kerberos_sid_group/ext_kerberos_sid_group_acl.8 new/squid-7.7/src/acl/external/kerberos_sid_group/ext_kerberos_sid_group_acl.8 --- old/squid-7.6/src/acl/external/kerberos_sid_group/ext_kerberos_sid_group_acl.8 2026-06-08 10:46:26.000000000 +0200 +++ new/squid-7.7/src/acl/external/kerberos_sid_group/ext_kerberos_sid_group_acl.8 2026-08-24 09:17:38.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "EXT_KERBEROS_SID_GROUP_ACL 8" -.TH EXT_KERBEROS_SID_GROUP_ACL 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH EXT_KERBEROS_SID_GROUP_ACL 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8 new/squid-7.7/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8 --- old/squid-7.6/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8 2026-06-08 10:46:29.000000000 +0200 +++ new/squid-7.7/src/acl/external/wbinfo_group/ext_wbinfo_group_acl.8 2026-08-24 09:17:40.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "EXT_WBINFO_GROUP_ACL 8" -.TH EXT_WBINFO_GROUP_ACL 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH EXT_WBINFO_GROUP_ACL 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/adaptation/icap/ModXact.cc new/squid-7.7/src/adaptation/icap/ModXact.cc --- old/squid-7.6/src/adaptation/icap/ModXact.cc 2026-04-20 10:41:19.000000000 +0200 +++ new/squid-7.7/src/adaptation/icap/ModXact.cc 2026-08-17 08:59:38.000000000 +0200 @@ -1399,12 +1399,18 @@ String vh=virgin.header->header.getById(Http::HdrType::PROXY_AUTHORIZATION); buf.appendf("Proxy-Authorization: " SQUIDSTRINGPH "\r\n", SQUIDSTRINGPRINT(vh)); } else if (request->extacl_user.size() > 0 && request->extacl_passwd.size() > 0) { + const auto userLen = request->extacl_user.size(); + const auto passwdLen = request->extacl_passwd.size(); + // +1 for the ':' separator between user and passwd + const auto plainLen = userLen + 1 + passwdLen; + if (plainLen > MAX_LOGIN_SZ) + throw TextException("extacl credentials too long for Proxy-Authorization", Here()); + char base64buf[base64_encode_len(MAX_LOGIN_SZ)]; struct base64_encode_ctx ctx; base64_encode_init(&ctx); - char base64buf[base64_encode_len(MAX_LOGIN_SZ)]; - size_t resultLen = base64_encode_update(&ctx, base64buf, request->extacl_user.size(), reinterpret_cast<const uint8_t*>(request->extacl_user.rawBuf())); + auto resultLen = base64_encode_update(&ctx, base64buf, userLen, reinterpret_cast<const uint8_t*>(request->extacl_user.rawBuf())); resultLen += base64_encode_update(&ctx, base64buf+resultLen, 1, reinterpret_cast<const uint8_t*>(":")); - resultLen += base64_encode_update(&ctx, base64buf+resultLen, request->extacl_passwd.size(), reinterpret_cast<const uint8_t*>(request->extacl_passwd.rawBuf())); + resultLen += base64_encode_update(&ctx, base64buf+resultLen, passwdLen, reinterpret_cast<const uint8_t*>(request->extacl_passwd.rawBuf())); resultLen += base64_encode_final(&ctx, base64buf+resultLen); buf.appendf("Proxy-Authorization: Basic %.*s\r\n", (int)resultLen, base64buf); } @@ -1560,8 +1566,11 @@ if (value) { if (TheConfig.client_username_encode) { + const auto valueLen = strlen(value); + if (valueLen > MAX_LOGIN_SZ) + throw TextException("username too long for X-Client-Username header", Here()); char base64buf[base64_encode_len(MAX_LOGIN_SZ)]; - size_t resultLen = base64_encode_update(&ctx, base64buf, strlen(value), reinterpret_cast<const uint8_t*>(value)); + size_t resultLen = base64_encode_update(&ctx, base64buf, valueLen, reinterpret_cast<const uint8_t*>(value)); resultLen += base64_encode_final(&ctx, base64buf+resultLen); buf.appendf("%s: %.*s\r\n", TheConfig.client_username_header, (int)resultLen, base64buf); } else diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/auth/basic/DB/basic_db_auth.8 new/squid-7.7/src/auth/basic/DB/basic_db_auth.8 --- old/squid-7.6/src/auth/basic/DB/basic_db_auth.8 2026-06-08 10:46:35.000000000 +0200 +++ new/squid-7.7/src/auth/basic/DB/basic_db_auth.8 2026-08-24 09:17:48.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "BASIC_DB_AUTH 8" -.TH BASIC_DB_AUTH 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH BASIC_DB_AUTH 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/auth/basic/POP3/basic_pop3_auth.8 new/squid-7.7/src/auth/basic/POP3/basic_pop3_auth.8 --- old/squid-7.6/src/auth/basic/POP3/basic_pop3_auth.8 2026-06-08 10:46:37.000000000 +0200 +++ new/squid-7.7/src/auth/basic/POP3/basic_pop3_auth.8 2026-08-24 09:17:50.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "BASIC_POP3_AUTH 8" -.TH BASIC_POP3_AUTH 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH BASIC_POP3_AUTH 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/clients/FtpClient.cc new/squid-7.7/src/clients/FtpClient.cc --- old/squid-7.6/src/clients/FtpClient.cc 2026-06-07 23:07:01.000000000 +0200 +++ new/squid-7.7/src/clients/FtpClient.cc 2026-08-17 08:59:38.000000000 +0200 @@ -844,6 +844,21 @@ void Ftp::Client::writeCommand(const char *buf) { + // The caller must supply a non-empty command followed by CRLF. + // TODO: Move CRLF appending code from callers to here. + const auto bufLen = strlen(buf); + Assure(bufLen > 2); + Assure(buf[bufLen-2] == '\r'); + Assure(buf[bufLen-1] == '\n'); + + const auto crlfCharPosition = strcspn(buf, crlf); + if (crlfCharPosition != bufLen-2) { + const auto invalidCharName = buf[crlfCharPosition] == '\r' ? "CR" : "LF"; + debugs(9, 2, "ERROR: Caller assembled a malformed FTP command. Found " << invalidCharName << " at position " << crlfCharPosition); + failed(ERR_FTP_FAILURE, 0); + return; + } + char *ebuf; /* trace FTP protocol communications at level 2 */ debugs(9, 2, "ftp<< " << buf); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/clients/FtpGateway.cc new/squid-7.7/src/clients/FtpGateway.cc --- old/squid-7.6/src/clients/FtpGateway.cc 2026-05-31 17:50:29.000000000 +0200 +++ new/squid-7.7/src/clients/FtpGateway.cc 2026-08-17 08:59:38.000000000 +0200 @@ -114,7 +114,6 @@ char *filepath; char *dirpath; int64_t restart_offset; - char *proxy_host; size_t list_width; String cwd_message; char *old_filepath; @@ -340,7 +339,6 @@ filepath(nullptr), dirpath(nullptr), restart_offset(0), - proxy_host(nullptr), list_width(0), old_filepath(nullptr), typecode('\0') @@ -1288,10 +1286,7 @@ if (!ftpState || !ftpState->haveControlChannel("ftpSendUser")) return; - if (ftpState->proxy_host != nullptr) - snprintf(cbuf, CTRL_BUFLEN, "USER %s@%s\r\n", ftpState->user, ftpState->request->url.host()); - else - snprintf(cbuf, CTRL_BUFLEN, "USER %s\r\n", ftpState->user); + snprintf(cbuf, CTRL_BUFLEN, "USER %s\r\n", ftpState->user); ftpState->writeCommand(cbuf); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/http/url_rewriters/LFS/url_lfs_rewrite.8 new/squid-7.7/src/http/url_rewriters/LFS/url_lfs_rewrite.8 --- old/squid-7.6/src/http/url_rewriters/LFS/url_lfs_rewrite.8 2026-06-08 10:46:43.000000000 +0200 +++ new/squid-7.7/src/http/url_rewriters/LFS/url_lfs_rewrite.8 2026-08-24 09:17:56.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "URL_LFS_REWRITE 8" -.TH URL_LFS_REWRITE 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH URL_LFS_REWRITE 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/http.cc new/squid-7.7/src/http.cc --- old/squid-7.6/src/http.cc 2026-04-20 10:41:19.000000000 +0200 +++ new/squid-7.7/src/http.cc 2026-08-17 08:59:38.000000000 +0200 @@ -1845,8 +1845,12 @@ username = request->auth_user_request->username(); #endif - blen = base64_encode_update(&ctx, loginbuf, strlen(username), reinterpret_cast<const uint8_t*>(username)); - blen += base64_encode_update(&ctx, loginbuf+blen, strlen(request->peer_login +1), reinterpret_cast<const uint8_t*>(request->peer_login +1)); + const auto usernameLen = strlen(username); + const auto suffixLen = strlen(request->peer_login + 1); + if (usernameLen + suffixLen > MAX_LOGIN_SZ) + throw TextException("peer login credentials too long", Here()); + blen = base64_encode_update(&ctx, loginbuf, usernameLen, reinterpret_cast<const uint8_t*>(username)); + blen += base64_encode_update(&ctx, loginbuf+blen, suffixLen, reinterpret_cast<const uint8_t*>(request->peer_login +1)); blen += base64_encode_final(&ctx, loginbuf+blen); httpHeaderPutStrf(hdr_out, header, "Basic %.*s", (int)blen, loginbuf); return; @@ -1857,9 +1861,14 @@ (strcmp(request->peer_login, "PASS") == 0 || strcmp(request->peer_login, "PROXYPASS") == 0)) { - blen = base64_encode_update(&ctx, loginbuf, request->extacl_user.size(), reinterpret_cast<const uint8_t*>(request->extacl_user.rawBuf())); + const auto userLen = request->extacl_user.size(); + const auto passwdLen = request->extacl_passwd.size(); + // +1 for the ':' separator between user and passwd + if (userLen + 1 + passwdLen > MAX_LOGIN_SZ) + throw TextException("extacl credentials too long for peer login", Here()); + blen = base64_encode_update(&ctx, loginbuf, userLen, reinterpret_cast<const uint8_t*>(request->extacl_user.rawBuf())); blen += base64_encode_update(&ctx, loginbuf+blen, 1, reinterpret_cast<const uint8_t*>(":")); - blen += base64_encode_update(&ctx, loginbuf+blen, request->extacl_passwd.size(), reinterpret_cast<const uint8_t*>(request->extacl_passwd.rawBuf())); + blen += base64_encode_update(&ctx, loginbuf+blen, passwdLen, reinterpret_cast<const uint8_t*>(request->extacl_passwd.rawBuf())); blen += base64_encode_final(&ctx, loginbuf+blen); httpHeaderPutStrf(hdr_out, header, "Basic %.*s", (int)blen, loginbuf); return; @@ -1889,7 +1898,10 @@ } #endif /* HAVE_KRB5 && HAVE_GSSAPI */ - blen = base64_encode_update(&ctx, loginbuf, strlen(request->peer_login), reinterpret_cast<const uint8_t*>(request->peer_login)); + const auto loginLen = strlen(request->peer_login); + if (loginLen > MAX_LOGIN_SZ) + throw TextException("peer_login too long", Here()); + blen = base64_encode_update(&ctx, loginbuf, loginLen, reinterpret_cast<const uint8_t*>(request->peer_login)); blen += base64_encode_final(&ctx, loginbuf+blen); httpHeaderPutStrf(hdr_out, header, "Basic %.*s", (int)blen, loginbuf); return; @@ -2012,6 +2024,7 @@ /* append Authorization if known in URL, not in header and going direct */ if (!hdr_out->has(Http::HdrType::AUTHORIZATION)) { if (flags.toOrigin && !request->url.userInfo().isEmpty()) { + Assure(request->url.userInfo().length() < MAX_URL*2); static char result[base64_encode_len(MAX_URL*2)]; // should be big enough for a single URI segment struct base64_encode_ctx ctx; base64_encode_init(&ctx); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/log/DB/log_db_daemon.8 new/squid-7.7/src/log/DB/log_db_daemon.8 --- old/squid-7.6/src/log/DB/log_db_daemon.8 2026-06-08 10:46:45.000000000 +0200 +++ new/squid-7.7/src/log/DB/log_db_daemon.8 2026-08-24 09:17:58.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "LOG_DB_DAEMON 8" -.TH LOG_DB_DAEMON 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH LOG_DB_DAEMON 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/peer_proxy_negotiate_auth.cc new/squid-7.7/src/peer_proxy_negotiate_auth.cc --- old/squid-7.6/src/peer_proxy_negotiate_auth.cc 2026-04-20 10:41:19.000000000 +0200 +++ new/squid-7.7/src/peer_proxy_negotiate_auth.cc 2026-08-17 08:59:38.000000000 +0200 @@ -13,6 +13,7 @@ #include "squid.h" #if HAVE_AUTH_MODULE_NEGOTIATE && HAVE_KRB5 && HAVE_GSSAPI +#include "base/Assure.h" #include "base64.h" #include "compat/krb5.h" #include "debug/Stream.h" @@ -546,6 +547,7 @@ static char b64buf[8192]; // XXX: 8KB only because base64_encode_bin() used to. struct base64_encode_ctx ctx; base64_encode_init(&ctx); + Assure(base64_encode_len(output_token.length) < sizeof(b64buf)); size_t blen = base64_encode_update(&ctx, b64buf, output_token.length, reinterpret_cast<const uint8_t*>(output_token.value)); blen += base64_encode_final(&ctx, b64buf+blen); b64buf[blen] = '\0'; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/security/cert_validators/fake/security_fake_certverify.8 new/squid-7.7/src/security/cert_validators/fake/security_fake_certverify.8 --- old/squid-7.6/src/security/cert_validators/fake/security_fake_certverify.8 2026-06-08 10:46:49.000000000 +0200 +++ new/squid-7.7/src/security/cert_validators/fake/security_fake_certverify.8 2026-08-24 09:18:02.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "SECURITY_FAKE_CERTVERIFY 8" -.TH SECURITY_FAKE_CERTVERIFY 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH SECURITY_FAKE_CERTVERIFY 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/servers/FtpServer.cc new/squid-7.7/src/servers/FtpServer.cc --- old/squid-7.6/src/servers/FtpServer.cc 2026-04-20 10:41:19.000000000 +0200 +++ new/squid-7.7/src/servers/FtpServer.cc 2026-08-17 08:59:38.000000000 +0200 @@ -641,15 +641,31 @@ { flags.readMore = false; // common for all but one case below - // OWS <command> [ RWS <parameter> ] OWS LF + // FTP command syntax is specified in RFC 959 Section 5.3. We generalize + // that grammar to parse all commands using the same code. We also relax the + // rules a little in hope to accommodate more real world use cases: + // * We allow ASCII HT, VT, and NP characters in various delimiters (in addition to SP). + // * We allow zero or more CR characters in command terminator (instead of exactly one). + // * We allow space characters before any command. + // + // command = BWS code [ RWS parameter ] OWS *CR LF + // code = 1*code_char + // parameter = 1*parameter_char ; without leading and trailing inner_space_chars + // code_char = ; any ASCII character other than space_char + // parameter_char = ; any ASCII character other than CR or LF + // BWS = 0*space_char ; optional "bad" space before the command code + // RWS = 1*inner_space_char ; required space before the command parameter + // OWS = 0*inner_space_char ; optional space after the command parameter + // inner_space_char = SP / HT / VT / NP ; space_char without CR and LF + // space_char = SP / HT / VT / NP / CR / LF; any isspace(3) character in "C" locale - // InlineSpaceChars are isspace(3) or RFC 959 Section 3.1.1.5.2, except - // for the LF character that we must exclude here (but see FullWhiteSpace). - static const char * const InlineSpaceChars = " \f\r\t\v"; + static const auto InlineSpaceChars = " \f\t\v"; static const CharacterSet InlineSpace = CharacterSet("Ftp::Inline", InlineSpaceChars); - static const CharacterSet FullWhiteSpace = (InlineSpace + CharacterSet::LF).rename("Ftp::FWS"); + static const CharacterSet CrLfChars = (CharacterSet::CR + CharacterSet::LF).rename("CRLF"); + static const CharacterSet FullWhiteSpace = (InlineSpace + CrLfChars).rename("Ftp::FWS"); static const CharacterSet CommandChars = FullWhiteSpace.complement("Ftp::Command"); - static const CharacterSet TailChars = CharacterSet::LF.complement("Ftp::Tail"); + // RFC 959 Section 5.3.2 excludes both CR and LF from <char> and <pr-char> definitions + static const CharacterSet TailChars = CrLfChars.complement("Ftp::Tail"); // This set is used to ignore empty commands without allowing an attacker // to keep us endlessly busy by feeding us whitespace or empty commands. @@ -663,7 +679,7 @@ (void)tok.skipAll(LeadingSpace); // leading OWS and empty commands const bool parsed = tok.prefix(cmd, CommandChars); // required command - // note that the condition below will eat either RWS or trailing OWS + // note that the condition below eats leading RWS and trailing OWS, if any if (parsed && tok.skipAll(InlineSpace) && tok.prefix(params, TailChars)) { // now params may include trailing OWS // TODO: Support right-trimming using CharacterSet in Tokenizer instead @@ -682,8 +698,21 @@ return earlyError(EarlyErrorKind::HugeRequest); } + if (parsed) + (void)tok.skipAll(CharacterSet::CR); + // technically, we may skip multiple NLs below, but that is OK if (!parsed || !tok.skipAll(CharacterSet::LF)) { // did not find terminating LF yet + + if (!tok.remaining().isEmpty()) { + // We always consume all valid input, so any leftovers imply that we + // found something that we cannot parse now and will never parse if + // more input becomes available later (e.g., `PWD\rQUIT\n`). + changeState(fssError, "bad FTP command syntax"); + quitAfterError(nullptr); + return earlyError(EarlyErrorKind::MalformedCommand); + } + // we need more data, but can we buffer more? if (inBuf.length() >= Config.maxRequestHeaderSize) { changeState(fssError, "huge req"); diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/src/store/id_rewriters/file/storeid_file_rewrite.8 new/squid-7.7/src/store/id_rewriters/file/storeid_file_rewrite.8 --- old/squid-7.6/src/store/id_rewriters/file/storeid_file_rewrite.8 2026-06-08 10:46:32.000000000 +0200 +++ new/squid-7.7/src/store/id_rewriters/file/storeid_file_rewrite.8 2026-08-24 09:17:43.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "STOREID_FILE_REWRITE 8" -.TH STOREID_FILE_REWRITE 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH STOREID_FILE_REWRITE 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/test-suite/test-squid-conf.sh new/squid-7.7/test-suite/test-squid-conf.sh --- old/squid-7.6/test-suite/test-squid-conf.sh 2026-04-20 10:41:19.000000000 +0200 +++ new/squid-7.7/test-suite/test-squid-conf.sh 2026-08-17 08:59:38.000000000 +0200 @@ -243,7 +243,11 @@ errorLog="squid-stderr.log" -$sbindir/squid -k parse -f $configFile 2> $errorLog +# Start `$sbindir/squid` from $configFile's directory, so that Squid can find files included by $configFile. +# If we decide to support relative `$sbindir` paths, we will add a portable realpath replacement. +configFileDirName=`dirname $configFile` +configFileBaseName=`basename $configFile` +(cd $configFileDirName && $sbindir/squid -k parse -f $configFileBaseName) 2> $errorLog result=$? # this is the value we return to our caller; diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' --exclude Makefile.in --exclude configure --exclude config.guess --exclude '*.pot' --exclude mkinstalldirs --exclude aclocal.m4 --exclude config.sub --exclude depcomp --exclude install-sh --exclude ltmain.sh old/squid-7.6/tools/helper-mux/helper-mux.8 new/squid-7.7/tools/helper-mux/helper-mux.8 --- old/squid-7.6/tools/helper-mux/helper-mux.8 2026-06-08 10:46:52.000000000 +0200 +++ new/squid-7.7/tools/helper-mux/helper-mux.8 2026-08-24 09:18:05.000000000 +0200 @@ -55,7 +55,7 @@ .\" ======================================================================== .\" .IX Title "HELPER-MUX 8" -.TH HELPER-MUX 8 2026-06-08 "perl v5.38.2" "User Contributed Perl Documentation" +.TH HELPER-MUX 8 2026-08-24 "perl v5.38.2" "User Contributed Perl Documentation" .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l ++++++ squid-7.6.tar.xz.asc -> squid-7.7.tar.xz.asc ++++++ --- /work/SRC/openSUSE:Factory/squid/squid-7.6.tar.xz.asc 2026-06-19 17:22:59.369405377 +0200 +++ /work/SRC/openSUSE:Factory/.squid.new.1265/squid-7.7.tar.xz.asc 2026-09-10 11:46:58.597464797 +0200 @@ -1,17 +1,18 @@ -File : squid-7.6.tar.xz -Date : Mon, 08 Jun 2026 08:33:32 +0000 -Size : 2436896 -MD5 : 5923f155668e83a20f696c90a0efdd66 -SHA1 : abf10758e1676c24d720f14cd11dd1c8b0502988 -SHA256 : 852178fdc37c5b0786a934fc990c7d2fffc82acf19b2284be209b96431d25992 +File : squid-7.7.tar.xz +Date : Mon, 24 Aug 2026 07:04:21 +0000 +Size : 2437896 +MD5 : 9b43e15c555cb78773f78746a96e10e4 +SHA1 : 3a30bbdad7324bbabbe83c80ae2262a555821e34 +SHA256 : e3bd613b91b1c498ec2992276063342a85cd6edddd5521294e04f44bc055da9b Key : 29B4B1F7CE03D1B1DED22F3028F85029FEF6E865 <[email protected]> -Fingerprint: +Fingerprint: 29B4 B1F7 CE03 D1B1 DED2 2F30 28F8 5029 FEF6 E865 +sub cv25519 2021-05-15 [E] Keyring : http://www.squid-cache.org/pgp.asc Keyserver: keyserver.ubuntu.com -----BEGIN PGP SIGNATURE----- -iHUEABYKAB0WIQQptLH3zgPRsd7SLzAo+FAp/vboZQUCaiaCGgAKCRAo+FAp/vbo -ZcSuAP9NubH6WBPiSAN6aVMY/b6+c9oTG/hqXm2ouoq9r92YTgEAggDii9Zti6Du -6aQ5mWmr1EfAXTMbWLfEvyKEVpb7yAo= -=Gu/S +iHUEABYKAB0WIQQptLH3zgPRsd7SLzAo+FAp/vboZQUCaovwYgAKCRAo+FAp/vbo +ZR63AP9tvTWMhC34miAx4PGJbIODAq3F12FYNJiQUoey3GNg0gEAjP97uHb9uAvb +u/3aweFKu2/ImJSmAtxiMUliYunKGwg= +=M9kh -----END PGP SIGNATURE-----
