The first patch isn't an upstream backport, it was submitted but never accepted. The second patch then deletes the code that the first patch modifies.
Drop the first patch and rebase the second as needed. Signed-off-by: Ross Burton <[email protected]> --- ...9813e0eb0246f63b54e9e154970e609575af.patch | 58 ------------------- .../xdg-utils/xdg-utils/CVE-2022-4055.patch | 25 ++++---- .../xdg-utils/xdg-utils_1.1.3.bb | 1 - 3 files changed, 15 insertions(+), 69 deletions(-) delete mode 100644 meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch b/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch deleted file mode 100644 index 948b9e22e93..00000000000 --- a/meta/recipes-extended/xdg-utils/xdg-utils/1f199813e0eb0246f63b54e9e154970e609575af.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 1f199813e0eb0246f63b54e9e154970e609575af Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <[email protected]> -Date: Tue, 18 Aug 2020 16:52:24 +0100 -Subject: [PATCH] xdg-email: remove attachment handling from mailto -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -This allows attacker to extract secrets from users: - -mailto:[email protected]?attach=/.gnupg/secring.gpg - -See also https://bugzilla.mozilla.org/show_bug.cgi?id=1613425 -and https://gitlab.freedesktop.org/xdg/xdg-utils/-/issues/177 - -Signed-off-by: Jörg Thalheim <[email protected]> ---- - scripts/xdg-email.in | 7 +------ - 1 file changed, 1 insertion(+), 6 deletions(-) - -Upstream-Status: Backport -CVE: CVE-2020-27748 - -diff --git a/scripts/xdg-email.in b/scripts/xdg-email.in -index 6db58ad..5d2f4f3 100644 ---- a/scripts/xdg-email.in -+++ b/scripts/xdg-email.in -@@ -32,7 +32,7 @@ _USAGE - - run_thunderbird() - { -- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH -+ local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY - THUNDERBIRD="$1" - MAILTO=$(echo "$2" | sed 's/^mailto://') - echo "$MAILTO" | grep -qs "^?" -@@ -48,7 +48,6 @@ run_thunderbird() - BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) - SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1) - BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1) -- ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//')) - - if [ -z "$TO" ] ; then - NEWMAILTO= -@@ -68,10 +67,6 @@ run_thunderbird() - NEWMAILTO="${NEWMAILTO},$BODY" - fi - -- if [ -n "$ATTACH" ] ; then -- NEWMAILTO="${NEWMAILTO},attachment='${ATTACH}'" -- fi -- - NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//') - DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\"" - "$THUNDERBIRD" -compose "$NEWMAILTO" --- -GitLab - diff --git a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch index b2360301088..85f32035fcd 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch +++ b/meta/recipes-extended/xdg-utils/xdg-utils/CVE-2022-4055.patch @@ -17,17 +17,17 @@ Signed-off-by: Richard Purdie <[email protected]> CVE: CVE-2022-4055 -Index: xdg-utils-1.1.3/scripts/xdg-email.in -=================================================================== ---- xdg-utils-1.1.3.orig/scripts/xdg-email.in -+++ xdg-utils-1.1.3/scripts/xdg-email.in -@@ -30,53 +30,6 @@ _USAGE +diff --git c/scripts/xdg-email.in w/scripts/xdg-email.in +index 3614776..8bdb5a9 100644 +--- c/scripts/xdg-email.in ++++ w/scripts/xdg-email.in +@@ -30,58 +30,6 @@ _USAGE #@xdg-utils-common@ -run_thunderbird() -{ -- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY +- local THUNDERBIRD MAILTO NEWMAILTO TO CC BCC SUBJECT BODY ATTACH - THUNDERBIRD="$1" - MAILTO=$(echo "$2" | sed 's/^mailto://') - echo "$MAILTO" | grep -qs "^?" @@ -43,6 +43,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in - BCC=$(/bin/echo -e $(echo "$MAILTO" | grep '^bcc=' | sed 's/^bcc=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }')) - SUBJECT=$(echo "$MAILTO" | grep '^subject=' | tail -n 1) - BODY=$(echo "$MAILTO" | grep '^body=' | tail -n 1) +- ATTACH=$(/bin/echo -e $(echo "$MAILTO" | grep '^attach=' | sed 's/^attach=//;s/%\(..\)/\\x\1/g' | awk '{ printf "%s,",$0 }' | sed 's/,$//')) - - if [ -z "$TO" ] ; then - NEWMAILTO= @@ -62,6 +63,10 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in - NEWMAILTO="${NEWMAILTO},$BODY" - fi - +- if [ -n "$ATTACH" ] ; then +- NEWMAILTO="${NEWMAILTO},attachment='${ATTACH}'" +- fi +- - NEWMAILTO=$(echo "$NEWMAILTO" | sed 's/^,//') - DEBUG 1 "Running $THUNDERBIRD -compose \"$NEWMAILTO\"" - "$THUNDERBIRD" -compose "$NEWMAILTO" @@ -75,7 +80,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in open_kde() { if [ -n "$KDE_SESSION_VERSION" ] && [ "$KDE_SESSION_VERSION" -ge 5 ]; then -@@ -130,15 +83,6 @@ open_kde() +@@ -135,15 +83,6 @@ open_kde() open_gnome3() { @@ -91,7 +96,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in if gio help open 2>/dev/null 1>&2; then DEBUG 1 "Running gio open \"$1\"" gio open "$1" -@@ -159,13 +103,6 @@ open_gnome3() +@@ -164,13 +103,6 @@ open_gnome3() open_gnome() { @@ -105,7 +110,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in if gio help open 2>/dev/null 1>&2; then DEBUG 1 "Running gio open \"$1\"" gio open "$1" -@@ -231,15 +168,6 @@ open_flatpak() +@@ -236,15 +168,6 @@ open_flatpak() open_generic() { @@ -121,7 +126,7 @@ Index: xdg-utils-1.1.3/scripts/xdg-email.in xdg-open "$1" local ret=$? -@@ -364,21 +292,6 @@ while [ $# -gt 0 ] ; do +@@ -369,21 +292,6 @@ while [ $# -gt 0 ] ; do shift ;; diff --git a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb index d7a103c1f81..482cf3aa7a3 100644 --- a/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb +++ b/meta/recipes-extended/xdg-utils/xdg-utils_1.1.3.bb @@ -8,7 +8,6 @@ LIC_FILES_CHKSUM = "file://LICENSE;md5=a5367a90934098d6b05af3b746405014" SRC_URI = "git://gitlab.freedesktop.org/xdg/xdg-utils.git;protocol=https;branch=master;tag=v${PV} \ file://0001-Reinstate-xdg-terminal.patch \ file://0001-Don-t-build-the-in-script-manual.patch \ - file://1f199813e0eb0246f63b54e9e154970e609575af.patch \ file://CVE-2022-4055.patch \ " -- 2.43.0
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#245767): https://lists.openembedded.org/g/openembedded-core/message/245767 Mute This Topic: https://lists.openembedded.org/mt/121241136/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
