Utkarsh Gupta pushed to branch fix-gen-dla-empty-version at Debian Security
Tracker / security-tracker
Commits:
863fa763 by Utkarsh Gupta at 2026-07-04T23:48:33+05:30
gen-DSA: don't leak unset version placeholders in generated advisories
- - - - -
1 changed file:
- bin/gen-DSA
Changes:
=====================================
bin/gen-DSA
=====================================
@@ -168,6 +168,27 @@ setvar() {
sed -i "s=\$$var=$value=g" "$tmpf"
}
+# Drop a suite with no version from $tmpf: strip its $<dist>_VERSION token
+# from any single-line field (e.g. "Version : ...") and remove any whole
+# paragraph that still references it, regardless of the template's wording.
+dropunsetversion() {
+ local dist="$1" token="\$${dist}_VERSION" token_re="\\\$${dist}_VERSION"
+
+ sed -Ei "/^[A-Za-z][A-Za-z0-9 ]*:[ ]/ s/ ?$token_re//" "$tmpf"
+
+ awk -v token="$token" '
+ BEGIN { RS=""; FS="\n"; n=0 }
+ { if (index($0, token) == 0) paras[n++]=$0 }
+ END {
+ for (i=0; i<n; i++) {
+ printf "%s", paras[i]
+ if (i<n-1) printf "\n\n"
+ }
+ }
+ ' "$tmpf" > "$tmpf.new"
+ mv "$tmpf.new" "$tmpf"
+}
+
if $color && [ -z "$NO_COLOR" ] && command -v tput >/dev/null ; then
RED=$(tput setaf 1)
YELLOW=$(tput setaf 3)
@@ -383,8 +404,13 @@ for dist in $CODENAMES; do
eval "${dist}_VERSION='$version'"
fi
fi
- [ -z "$version" ] || setvar "${dist}_VERSION" "$version"
- [ -z "$version" ] || DISTS="${DISTS},${dist}"
+ if [ -n "$version" ]; then
+ setvar "${dist}_VERSION" "$version"
+ DISTS="${DISTS},${dist}"
+ elif $save; then
+ # no version for this suite: don't leak its unsubstituted placeholder
+ dropunsetversion "$dist"
+ fi
done
DISTS="${DISTS#,}"
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/863fa7639753f41c34dcbc6d7297ca73ec43968e
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/863fa7639753f41c34dcbc6d7297ca73ec43968e
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
