Hello community, here is the log from the commit of package rubygem-rdoc.1342 for openSUSE:12.1:Update checked in at 2013-02-15 14:23:13 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:12.1:Update/rubygem-rdoc.1342 (Old) and /work/SRC/openSUSE:12.1:Update/.rubygem-rdoc.1342.new (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "rubygem-rdoc.1342", Maintainer is "" Changes: -------- New Changes file: --- /dev/null 2013-02-09 11:18:20.872010756 +0100 +++ /work/SRC/openSUSE:12.1:Update/.rubygem-rdoc.1342.new/rubygem-rdoc.changes 2013-02-15 14:23:15.000000000 +0100 @@ -0,0 +1,23 @@ +------------------------------------------------------------------- +Wed Feb 13 17:16:11 UTC 2013 - mrueck...@suse.de + +- added ffa87887ee0517793df7541629a470e331f9fe60.patch: + (bnc#802406): CVE-2013-0256: rubygem-rdoc: XSS exploit of RDoc + documentation generated by rdoc + +------------------------------------------------------------------- +Wed Dec 8 11:31:27 UTC 2010 - mrueck...@suse.de + +- recommend rdoc-data + +------------------------------------------------------------------- +Wed Dec 8 00:16:47 UTC 2010 - mrueck...@suse.de + +- suffix scripts with "-gem" to avoid conflicts with the main ruby + package + +------------------------------------------------------------------- +Tue Dec 7 23:30:13 UTC 2010 - mrueck...@suse.de + +- initial package version 2.5.11 + New: ---- ffa87887ee0517793df7541629a470e331f9fe60.patch rdoc-2.5.11.gem rubygem-rdoc.changes rubygem-rdoc.spec ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ rubygem-rdoc.spec ++++++ # # spec file for package rubygem-rdoc # # Copyright (c) 2011 SUSE LINUX Products GmbH, Nuernberg, Germany. # # All modifications and additions to the file contributed by third parties # remain the property of their copyright owners, unless otherwise agreed # upon. The license for this file, and modifications and additions to the # file, is the same license as for the pristine package itself (unless the # license for the pristine package is not an Open Source License, in which # case the license is the MIT License). An "Open Source License" is a # license that conforms to the Open Source Definition (Version 1.9) # published by the Open Source Initiative. # Please submit bugfixes or comments via http://bugs.opensuse.org/ # # norootforbuild Name: rubygem-rdoc Version: 2.5.11 Release: 1 %define mod_name rdoc # Group: Development/Languages/Ruby License: GPLv2+ or Ruby # BuildRoot: %{_tmppath}/%{name}-%{version}-build BuildRequires: rubygems_with_buildroot_patch %rubygems_requires Recommends: rubygem-rdoc-data >= 2.5.3 # Url: http://rdoc.rubyforge.org Source: %{mod_name}-%{version}.gem Patch0: ffa87887ee0517793df7541629a470e331f9fe60.patch # Summary: RDoc is an application that produces documentation for one or more Ruby source files %description RDoc is an application that produces documentation for one or more Ruby source files. RDoc includes the +rdoc+ and +ri+ tools for generating and displaying online documentation. At this point in time, RDoc 2.x is a work in progress and may incur further API changes beyond what has been made to RDoc 1.0.1. Command-line tools are largely unaffected, but internal APIs may shift rapidly. See RDoc for a description of RDoc's markup and basic use. %prep %build %install %gem_install %{S:0} pushd %{buildroot}%{_libdir}/ruby/gems/%{rb_ver}/gems/%{mod_name}-%{version}/ patch -p0 < %{P:0} popd for i in %{buildroot}%{_bindir}/* ; do mv $i ${i}-gem ; done %clean %{__rm} -rf %{buildroot} %files %defattr(-,root,root,-) %{_bindir}/rdoc-gem %{_bindir}/ri-gem %{_libdir}/ruby/gems/%{rb_ver}/cache/%{mod_name}-%{version}.gem %{_libdir}/ruby/gems/%{rb_ver}/gems/%{mod_name}-%{version}/ %{_libdir}/ruby/gems/%{rb_ver}/specifications/%{mod_name}-%{version}.gemspec %doc %{_libdir}/ruby/gems/%{rb_ver}/doc/%{mod_name}-%{version}/ %changelog ++++++ ffa87887ee0517793df7541629a470e331f9fe60.patch ++++++ >From ffa87887ee0517793df7541629a470e331f9fe60 Mon Sep 17 00:00:00 2001 From: Eric Hodel <drbr...@segment7.net> Date: Tue, 5 Feb 2013 19:57:58 -0800 Subject: [PATCH] Fix CVE-2013-0256, an XSS exploit in RDoc See CVE-2013-0256 for details on the exploit including a patch you can apply to generated RDoc output. --- CVE-2013-0256.rdoc | 49 ++++++++++++++++++++ History.rdoc | 5 +- Manifest.txt | 1 + Rakefile | 1 + lib/rdoc.rb | 2 +- .../generator/template/darkfish/js/darkfish.js | 16 ++++--- 6 files changed, 65 insertions(+), 9 deletions(-) create mode 100644 CVE-2013-0256.rdoc Index: CVE-2013-0256.rdoc =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ CVE-2013-0256.rdoc 2013-02-13 18:12:59.016554966 +0100 @@ -0,0 +1,49 @@ += RDoc 2.3.0 through 3.12 XSS Exploit + +RDoc documentation generated by rdoc 2.3.0 through rdoc 3.12 and prereleases up +to rdoc 4.0.0.preview2.1 are vulnerable to an XSS exploit. This exploit may +lead to cookie disclosure to third parties. + +The exploit exists in darkfish.js which is copied from the RDoc install +location to the generated documentation. + +RDoc is a static documentation generation tool. Patching the library itself +is insufficient to correct this exploit. Those hosting rdoc documentation will +need to apply the following patch. If applied while ignoring whitespace, this +patch will correct all affected versions: + + diff --git darkfish.js darkfish.js + index 4be722f..f26fd45 100644 + --- darkfish.js + +++ darkfish.js + @@ -109,13 +109,15 @@ function hookSearch() { + function highlightTarget( anchor ) { + console.debug( "Highlighting target '%s'.", anchor ); + + - $("a[name=" + anchor + "]").each( function() { + - if ( !$(this).parent().parent().hasClass('target-section') ) { + - console.debug( "Wrapping the target-section" ); + - $('div.method-detail').unwrap( 'div.target-section' ); + - $(this).parent().wrap( '<div class="target-section"></div>' ); + - } else { + - console.debug( "Already wrapped." ); + + $("a[name]").each( function() { + + if ( $(this).attr("name") == anchor ) { + + if ( !$(this).parent().parent().hasClass('target-section') ) { + + console.debug( "Wrapping the target-section" ); + + $('div.method-detail').unwrap( 'div.target-section' ); + + $(this).parent().wrap( '<div class="target-section"></div>' ); + + } else { + + console.debug( "Already wrapped." ); + + } + } + }); + }; + +RDoc 3.9.5, 3.12.1 and RDoc 4.0.0.rc.2 and newer are not vulnerable to this +exploit. + +This exploit was discovered by Evgeny Ermakov <cor...@gmail.com>. + +This vulnerability has been assigned the CVE identifier CVE-2013-0256. + Index: lib/rdoc/generator/template/darkfish/js/darkfish.js =================================================================== --- lib/rdoc/generator/template/darkfish/js/darkfish.js.orig 2013-02-13 18:08:59.057573129 +0100 +++ lib/rdoc/generator/template/darkfish/js/darkfish.js 2013-02-13 18:12:59.017554966 +0100 @@ -73,13 +73,15 @@ function hookQuickSearch() { function highlightTarget( anchor ) { console.debug( "Highlighting target '%s'.", anchor ); - $("a[name=" + anchor + "]").each( function() { - if ( !$(this).parent().parent().hasClass('target-section') ) { - console.debug( "Wrapping the target-section" ); - $('div.method-detail').unwrap( 'div.target-section' ); - $(this).parent().wrap( '<div class="target-section"></div>' ); - } else { - console.debug( "Already wrapped." ); + $("a[name]").each( function() { + if ( $(this).attr("name") == anchor ) { + if ( !$(this).parent().parent().hasClass('target-section') ) { + console.debug( "Wrapping the target-section" ); + $('div.method-detail').unwrap( 'div.target-section' ); + $(this).parent().wrap( '<div class="target-section"></div>' ); + } else { + console.debug( "Already wrapped." ); + } } }); }; -- To unsubscribe, e-mail: opensuse-commit+unsubscr...@opensuse.org For additional commands, e-mail: opensuse-commit+h...@opensuse.org
