Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package hawk2 for openSUSE:Factory checked in at 2026-10-29 16:11:06 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/hawk2 (Old) and /work/SRC/openSUSE:Factory/.hawk2.new.1255 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "hawk2" Thu Oct 29 16:11:06 2026 rev:51 rq:1393603 version:2.7.2+git.1792148770.648dcddb Changes: -------- --- /work/SRC/openSUSE:Factory/hawk2/hawk2.changes 2026-10-16 20:14:33.814458899 +0200 +++ /work/SRC/openSUSE:Factory/.hawk2.new.1255/hawk2.changes 2026-10-29 16:12:52.461502700 +0100 @@ -1,0 +2,6 @@ +Thu Oct 29 10:16:32 UTC 2026 - Aleksei Burlakov <[email protected]> + +- bump ruby gem crass-1.0.7 --> crass-1.0.8 (bsc#1288620): + * crass-1.0.8.gem + +------------------------------------------------------------------- Old: ---- crass-1.0.7.gem New: ---- crass-1.0.8.gem ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ hawk2.spec ++++++ --- /var/tmp/diff_new_pack.AipVxb/_old 2026-10-29 16:12:54.932606332 +0100 +++ /var/tmp/diff_new_pack.AipVxb/_new 2026-10-29 16:12:54.934606416 +0100 @@ -66,7 +66,7 @@ Source18: coercible-1.0.0.gem Source19: concurrent-ruby-1.3.8.gem Source20: connection_pool-3.0.2.gem -Source21: crass-1.0.7.gem +Source21: crass-1.0.8.gem Source22: date-3.5.1.gem Source23: descendants_tracker-0.0.4.gem Source24: drb-2.2.3.gem ++++++ crass-1.0.7.gem -> crass-1.0.8.gem ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/HISTORY.md new/HISTORY.md --- old/HISTORY.md 1980-01-02 01:00:00.000000000 +0100 +++ new/HISTORY.md 1980-01-02 01:00:00.000000000 +0100 @@ -1,5 +1,11 @@ # Crass Changelog +## 1.0.8 (2026-10-21) + +### Security + +- Moderate: Fixed a tokenizer bug in which a `)` following an escaped backslash (`\\`) inside a bad URL didn't terminate the bad URL token, causing Crass to consume more input than a spec-compliant browser would. CSS sanitizers built on Crass could be tricked into passing through declarations, rules, or at-rules that a browser would then apply. (GHSA-pq4g-8rxf-4g29) + ## 1.0.7 (2026-06-25) ### Security diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/SECURITY.md new/SECURITY.md --- old/SECURITY.md 1970-01-01 01:00:00.000000000 +0100 +++ new/SECURITY.md 1980-01-02 01:00:00.000000000 +0100 @@ -0,0 +1,3 @@ +# Security Policy + +To report a security vulnerability in Crass, please email [[email protected]](mailto:[email protected]) or use GitHub's [Report a vulnerability](https://github.com/rgrove/crass/security/advisories/new) feature. Binary files old/checksums.yaml.gz and new/checksums.yaml.gz differ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/crass/tokenizer.rb new/lib/crass/tokenizer.rb --- old/lib/crass/tokenizer.rb 1980-01-02 01:00:00.000000000 +0100 +++ new/lib/crass/tokenizer.rb 1980-01-02 01:00:00.000000000 +0100 @@ -89,7 +89,7 @@ case char.to_sym when :'"' - consume_string + consume_string(char) when :'#' if @s.peek =~ RE_NAME || valid_escape?(@s.peek(2)) @@ -109,7 +109,7 @@ end when :"'" - consume_string + consume_string(char) when :'(' create_token(:'(') @@ -132,7 +132,7 @@ end when :+ - if start_number? + if start_number?(char + @s.peek(2)) @s.reconsume consume_numeric else @@ -161,7 +161,7 @@ end when :'.' - if start_number? + if start_number?(char + @s.peek(2)) @s.reconsume consume_numeric else @@ -196,7 +196,7 @@ create_token(:'[') when :'\\' - if valid_escape? + if valid_escape?(char + @s.peek) @s.reconsume consume_ident else @@ -277,9 +277,7 @@ text = String.new until @s.eos? - if valid_escape? - text << consume_escaped - elsif valid_escape?(@s.peek(2)) + if valid_escape?(@s.peek(2)) @s.consume text << consume_escaped else @@ -320,8 +318,8 @@ # Consumes an escaped code point and returns its unescaped value. # # This method assumes that the `\` has already been consumed, and that the - # next character in the input has already been verified not to be a newline - # or EOF. + # next character in the input has already been verified not to be a + # newline. If the input is at EOF, U+FFFD is returned. # # 4.3.8. https://www.w3.org/TR/2013/WD-css-syntax-3-20130919/#consume-an-escaped-code-point def consume_escaped @@ -384,7 +382,7 @@ char = @s.consume - if valid_escape? + if valid_escape?(char + @s.peek) result << consume_escaped # Non-standard: IE * hack @@ -567,7 +565,7 @@ :value => value + consume_bad_url) when '\\' - if valid_escape? + if valid_escape?(char + @s.peek) value << consume_escaped else # Parse error. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/lib/crass/version.rb new/lib/crass/version.rb --- old/lib/crass/version.rb 1980-01-02 01:00:00.000000000 +0100 +++ new/lib/crass/version.rb 1980-01-02 01:00:00.000000000 +0100 @@ -1,5 +1,5 @@ # encoding: utf-8 module Crass - VERSION = '1.0.7' + VERSION = '1.0.8' end diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/metadata new/metadata --- old/metadata 1980-01-02 01:00:00.000000000 +0100 +++ new/metadata 1980-01-02 01:00:00.000000000 +0100 @@ -1,7 +1,7 @@ --- !ruby/object:Gem::Specification name: crass version: !ruby/object:Gem::Version - version: 1.0.7 + version: 1.0.8 platform: ruby authors: - Ryan Grove @@ -52,6 +52,7 @@ - LICENSE - README.md - Rakefile +- SECURITY.md - crass.gemspec - lib/crass.rb - lib/crass/parser.rb @@ -64,10 +65,10 @@ - MIT metadata: bug_tracker_uri: https://github.com/rgrove/crass/issues - changelog_uri: https://github.com/rgrove/crass/blob/v1.0.7/HISTORY.md - documentation_uri: https://www.rubydoc.info/gems/crass/1.0.7 + changelog_uri: https://github.com/rgrove/crass/blob/v1.0.8/HISTORY.md + documentation_uri: https://www.rubydoc.info/gems/crass/1.0.8 rubygems_mfa_required: 'true' - source_code_uri: https://github.com/rgrove/crass/tree/v1.0.7 + source_code_uri: https://github.com/rgrove/crass/tree/v1.0.8 rdoc_options: [] require_paths: - lib @@ -82,7 +83,7 @@ - !ruby/object:Gem::Version version: '0' requirements: [] -rubygems_version: 4.0.10 +rubygems_version: 4.0.20 specification_version: 4 summary: CSS parser based on the CSS Syntax Level 3 spec. test_files: [] ++++++ gemfile-lock.patch ++++++ --- /var/tmp/diff_new_pack.AipVxb/_old 2026-10-29 16:12:55.314622353 +0100 +++ /var/tmp/diff_new_pack.AipVxb/_new 2026-10-29 16:12:55.318622520 +0100 @@ -116,7 +116,7 @@ + descendants_tracker (~> 0.0.1) + concurrent-ruby (1.3.8) + connection_pool (3.0.2) -+ crass (1.0.7) ++ crass (1.0.8) + date (3.5.1) + descendants_tracker (0.0.4) + thread_safe (~> 0.3, >= 0.3.1) @@ -335,7 +335,7 @@ + coercible (1.0.0) sha256=5081ad24352cc8435ce5472bc2faa30260c7ea7f2102cc6a9f167c4d9bffaadc + concurrent-ruby (1.3.8) sha256=b2f1be836e968ccc78ccfce277ea79c72a88633f22306782c16ff23fb415d1e1 + connection_pool (3.0.2) sha256=33fff5ba71a12d2aa26cb72b1db8bba2a1a01823559fb01d29eb74c286e62e0a -+ crass (1.0.7) sha256=94868719948664c89ddcaf0a37c65048413dfcb1c869470a5f7a7ceb5390b295 ++ crass (1.0.8) sha256=7a0145c7a2c59f8e7923b3a69ce819c444823a00a5127d805298fea13be24efe + date (3.5.1) sha256=750d06384d7b9c15d562c76291407d89e368dda4d4fff957eb94962d325a0dc0 + descendants_tracker (0.0.4) sha256=e9c41dd4cfbb85829a9301ea7e7c48c2a03b26f09319db230e6479ccdc780897 + drb (2.2.3) sha256=0b00d6fdb50995fe4a45dea13663493c841112e4068656854646f418fda13373
