Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package ghc-text-iso8601 for openSUSE:Factory checked in at 2026-11-06 19:50:24 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/ghc-text-iso8601 (Old) and /work/SRC/openSUSE:Factory/.ghc-text-iso8601.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "ghc-text-iso8601" Fri Nov 6 19:50:24 2026 rev:6 rq:1395573 version:0.1.1.2 Changes: -------- --- /work/SRC/openSUSE:Factory/ghc-text-iso8601/ghc-text-iso8601.changes 2026-06-10 16:11:27.322224627 +0200 +++ /work/SRC/openSUSE:Factory/.ghc-text-iso8601.new.3759290/ghc-text-iso8601.changes 2026-11-06 19:57:26.591841422 +0100 @@ -1,0 +2,9 @@ +Sat Aug 29 13:20:17 UTC 2026 - Peter Simons <[email protected]> + +- Update text-iso8601 to version 0.1.1.2. + Upstream has edited the change log file since the last release in + a non-trivial way, i.e. they did more than just add a new entry + at the top. You can review the file at: + http://hackage.haskell.org/package/text-iso8601-0.1.1.2/src/changelog.md + +------------------------------------------------------------------- Old: ---- text-iso8601-0.1.1.1.tar.gz New: ---- text-iso8601-0.1.1.2.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ ghc-text-iso8601.spec ++++++ --- /var/tmp/diff_new_pack.MK2cpC/_old 2026-11-06 19:57:27.676886842 +0100 +++ /var/tmp/diff_new_pack.MK2cpC/_new 2026-11-06 19:57:27.678886926 +0100 @@ -20,7 +20,7 @@ %global pkgver %{pkg_name}-%{version} %bcond_with tests Name: ghc-%{pkg_name} -Version: 0.1.1.1 +Version: 0.1.1.2 Release: 0 Summary: Converting time to and from ISO 8601 text License: BSD-3-Clause ++++++ text-iso8601-0.1.1.1.tar.gz -> text-iso8601-0.1.1.2.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/text-iso8601-0.1.1.1/changelog.md new/text-iso8601-0.1.1.2/changelog.md --- old/text-iso8601-0.1.1.1/changelog.md 2001-09-09 03:46:40.000000000 +0200 +++ new/text-iso8601-0.1.1.2/changelog.md 2001-09-09 03:46:40.000000000 +0200 @@ -1,6 +1,16 @@ +# 0.1.1.2 - 2026-08-29 + +Fix a DoS vulnerability caused by parsing large numbers (advisory [HSEC-2026-0007](https://haskell.github.io/security-advisories/advisory/HSEC-2026-0007.html)). Backported from 0.2.0.0 to ease migration. + +- Fix parsers to reject years with more than 15 digits + +# 0.1.1.1 + +- Support GHC-9.14 + # 0.1.1 -- Support GHC-8.6.5...9.10.1 +- Support GHC-8.6.5...9.12.1 # 0.1 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/text-iso8601-0.1.1.1/src/Data/Time/FromText.hs new/text-iso8601-0.1.1.2/src/Data/Time/FromText.hs --- old/text-iso8601-0.1.1.1/src/Data/Time/FromText.hs 2001-09-09 03:46:40.000000000 +0200 +++ new/text-iso8601-0.1.1.2/src/Data/Time/FromText.hs 2001-09-09 03:46:40.000000000 +0200 @@ -272,19 +272,24 @@ start :: Int -> Int -> Either String r start !off !len = unconsAscii_ arr off len (unexpectedEOF "-, +, or a digit") $ \c off' len' -> case c of - '-' -> loop negate off' off' len' - '+' -> loop id off' off' len' + -- year is capped to 15 digits and we try consuming one more before raising an error, hence max 16 digits + '-' -> loop negate off' off' (min len' 16) + '+' -> loop id off' off' (min len' 16) _ - | '0' <= c, c <= '9' -> loop id off off' len' + | '0' <= c, c <= '9' -> loop id off off' (min len' 15) -- already consumed first digit, 15 left | otherwise -> Left $ "Unexpected '" ++ show c ++ ", expecting -, +, or a digit" + -- The caller must make sure not to consume too many digits, to avoid complexity blow up in conversion to Integer! loop :: (Integer -> Integer) -> Int -> Int -> Int -> Either String r loop !posNeg !off0 !off !len = unconsAscii_ arr off len (finishEOF posNeg off0 off) $ \c off' len' -> if | '0' <= c, c <= '9' -> loop posNeg off0 off' len' - | otherwise -> finishC posNeg c off0 off off' len' + | otherwise -> finishC posNeg c off0 off off' (lenS - (off' - offS)) -- restore the full remaining length finishEOF :: (Integer -> Integer) -> Int -> Int -> Either String r finishEOF !posNeg !off0 !off + | len0 >= 16 + = Left "expected year with at most 15 digits" + | len0 >= 4 = year `seq` kontEOF year diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/text-iso8601-0.1.1.1/tests/text-iso8601-tests.hs new/text-iso8601-0.1.1.2/tests/text-iso8601-tests.hs --- old/text-iso8601-0.1.1.1/tests/text-iso8601-tests.hs 2001-09-09 03:46:40.000000000 +0200 +++ new/text-iso8601-0.1.1.2/tests/text-iso8601-tests.hs 2001-09-09 03:46:40.000000000 +0200 @@ -12,7 +12,7 @@ property) import Test.QuickCheck.Instances () import Test.Tasty (TestTree, defaultMain, testGroup) -import Test.Tasty.HUnit (assertFailure, testCase) +import Test.Tasty.HUnit (assertEqual, assertFailure, testCase) import Test.Tasty.QuickCheck (testProperty) import qualified Data.Text as T @@ -65,19 +65,27 @@ , testGroup "rejected" -- https://github.com/haskell/aeson/issues/1033 - [ rejects T.parseUTCTime "2023-06-09T02:35:33 Z" + [ rejects T.parseUTCTime "2023-06-09T02:35:33 Z" "Unexpected ' ', expecting timezone: Z, +HH:MM or -HH:MM" -- Y2K years - , rejects T.parseDay "99-12-12" + , rejects T.parseDay "99-12-12" "expected year with at least 4 digits" -- we don't accept lowercase T or Z -- RFC3339 says we MAY limit, i.e. requiring they should be uppercase. - , rejects T.parseUTCTime "2023-06-09T02:35:33z" - , rejects T.parseUTCTime "2023-06-09t02:35:33Z" + , rejects T.parseUTCTime "2023-06-09T02:35:33z" "Unexpected 'z', expecting timezone: Z, +HH:MM or -HH:MM" + , rejects T.parseUTCTime "2023-06-09t02:35:33Z" "Unexpected 't', expecting a day separator, T or space" -- accepts +23:59, but not 24 or 60 - , rejects T.parseUTCTime "1937-01-01T12:00:00+24:59" - , rejects T.parseUTCTime "1937-01-01T12:00:00-23:60" + , rejects T.parseUTCTime "1937-01-01T12:00:00+24:59" "Invalid TimeZone:(24,59)" + , rejects T.parseUTCTime "1937-01-01T12:00:00-23:60" "Invalid TimeZone:(23,60)" + + -- rejects 24:xx:xx except 24:00:00 + , rejects T.parseUTCTime "1990-12-31T24:00:01Z" "Invalid time of day:(24,0,1.000000000000)" + , rejects T.parseUTCTime "1990-12-31T24:00:60Z" "Invalid time of day:(24,0,60.000000000000)" + , rejects T.parseUTCTime "1990-12-31T24:01:00Z" "Invalid time of day:(24,1,0.000000000000)" + + -- Reject long years + , rejects T.parseUTCTime "1234567890123456-01-01T01:01Z" "expected year with at most 15 digits" ] ] @@ -98,10 +106,10 @@ counterexample (show y) $ property (liftEq eq y (Right x)) -rejects :: forall a. (Typeable a, Show a) => (Text -> Either String a) -> String -> TestTree -rejects parse inp = testCase (show (typeRep (Proxy :: Proxy a)) ++ " rejects " ++ show inp) $ do +rejects :: forall a. (Typeable a, Show a) => (Text -> Either String a) -> String -> String -> TestTree +rejects parse inp expected = testCase (show (typeRep (Proxy :: Proxy a)) ++ " rejects " ++ show inp) $ do case parse (T.pack inp) of - Left _ -> return () + Left actual -> assertEqual "Error message mismatch" actual expected Right a -> assertFailure $ "Unexpectedly accepted: " ++ show a accepts :: forall a. (Typeable a, Show a) => (Text -> Either String a) -> String -> TestTree diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/text-iso8601-0.1.1.1/text-iso8601.cabal new/text-iso8601-0.1.1.2/text-iso8601.cabal --- old/text-iso8601-0.1.1.1/text-iso8601.cabal 2001-09-09 03:46:40.000000000 +0200 +++ new/text-iso8601-0.1.1.2/text-iso8601.cabal 2001-09-09 03:46:40.000000000 +0200 @@ -1,6 +1,6 @@ cabal-version: 1.12 name: text-iso8601 -version: 0.1.1.1 +version: 0.1.1.2 synopsis: Converting time to and from ISO 8601 text. description: Converting time to and from IS0 8601 text. @@ -26,7 +26,7 @@ || ==9.4.8 || ==9.6.6 || ==9.8.4 - || ==9.10.1 + || ==9.10.3 || ==9.12.4 || ==9.14.1
