diff options
author | taca <taca@pkgsrc.org> | 2013-02-12 13:03:08 +0000 |
---|---|---|
committer | taca <taca@pkgsrc.org> | 2013-02-12 13:03:08 +0000 |
commit | e4845898c5605fd5e3ed87b5823b49ac0a33faba (patch) | |
tree | f75e6e70533a44d8dc6fba12735f4be6327f7275 /lang | |
parent | 1750cbd20010a3750235cc753ac3296c502cb8e6 (diff) | |
download | pkgsrc-e4845898c5605fd5e3ed87b5823b49ac0a33faba.tar.gz |
* Add fix for CVE-2013-0269, json vulnerability.
* Add comments to patches related to mdoc markup.
Bump PKGREVISION.
Diffstat (limited to 'lang')
-rw-r--r-- | lang/ruby193-base/Makefile | 4 | ||||
-rw-r--r-- | lang/ruby193-base/PLIST | 4 | ||||
-rw-r--r-- | lang/ruby193-base/distinfo | 18 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-ext_json_lib_json_add_core.rb | 32 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-ext_json_lib_json_common.rb | 54 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-ext_json_lib_json_version.rb | 14 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-ext_json_parser_parser.c | 15 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-ext_json_parser_parser.rl | 25 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-man_erb.1 | 4 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-man_irb.1 | 4 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-man_ri.1 | 4 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-man_ruby.1 | 4 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-test_json_test__json.rb | 55 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-test_json_test__json__addition.rb | 104 | ||||
-rw-r--r-- | lang/ruby193-base/patches/patch-test_json_test__json__string__matching.rb | 26 |
15 files changed, 354 insertions, 13 deletions
diff --git a/lang/ruby193-base/Makefile b/lang/ruby193-base/Makefile index 340324ce6b2..18f2f725a8a 100644 --- a/lang/ruby193-base/Makefile +++ b/lang/ruby193-base/Makefile @@ -1,9 +1,9 @@ -# $NetBSD: Makefile,v 1.24 2013/02/06 23:22:39 jperkin Exp $ +# $NetBSD: Makefile,v 1.25 2013/02/12 13:03:08 taca Exp $ # DISTNAME= ${RUBY_DISTNAME} PKGNAME= ${RUBY_PKGPREFIX}-base-${RUBY_VERSION_FULL} -PKGREVISION= 1 +PKGREVISION= 2 CATEGORIES= lang ruby MASTER_SITES= ${MASTER_SITE_RUBY} diff --git a/lang/ruby193-base/PLIST b/lang/ruby193-base/PLIST index 1281be5a227..89a3eb7a375 100644 --- a/lang/ruby193-base/PLIST +++ b/lang/ruby193-base/PLIST @@ -1,4 +1,4 @@ -@comment $NetBSD: PLIST,v 1.6 2013/02/06 15:48:31 taca Exp $ +@comment $NetBSD: PLIST,v 1.7 2013/02/12 13:03:08 taca Exp $ bin/erb${RUBY_VER} bin/gem${RUBY_VER} bin/irb${RUBY_VER} @@ -774,7 +774,7 @@ ${GEM_HOME}/gems/rdoc-3.9.5/bin/rdoc${RUBY_VER} ${GEM_HOME}/gems/rdoc-3.9.5/bin/ri${RUBY_VER} ${GEM_HOME}/specifications/bigdecimal-1.1.0.gemspec ${GEM_HOME}/specifications/io-console-0.3.gemspec -${GEM_HOME}/specifications/json-1.5.4.gemspec +${GEM_HOME}/specifications/json-1.5.5.gemspec ${GEM_HOME}/specifications/minitest-2.5.1.gemspec ${GEM_HOME}/specifications/rake-0.9.2.2.gemspec ${GEM_HOME}/specifications/rdoc-3.9.5.gemspec diff --git a/lang/ruby193-base/distinfo b/lang/ruby193-base/distinfo index 5b5495b94ef..64192c8afa7 100644 --- a/lang/ruby193-base/distinfo +++ b/lang/ruby193-base/distinfo @@ -1,4 +1,4 @@ -$NetBSD: distinfo,v 1.16 2013/02/06 15:48:31 taca Exp $ +$NetBSD: distinfo,v 1.17 2013/02/12 13:03:09 taca Exp $ SHA1 (ruby-1.9.3-p385.tar.bz2) = 54e8d08103e915e2b07dcfcea88ab7fc42d40b0a RMD160 (ruby-1.9.3-p385.tar.bz2) = b2fbe56de1295659aa54c0a2d9f77a1212f62a02 @@ -6,6 +6,11 @@ Size (ruby-1.9.3-p385.tar.bz2) = 10021486 bytes SHA1 (patch-configure) = e72a5414a9e706962692e645173c5b47ddb41932 SHA1 (patch-configure.in) = 0996411e3125a298c770f4eead0edbc530a0a584 SHA1 (patch-defs_default__gems) = fb24111736f1a76a05e853aa068024dbdd24e5a5 +SHA1 (patch-ext_json_lib_json_add_core.rb) = d5dc99b3ae708a3866bd7dc67d232f99f91ec6ff +SHA1 (patch-ext_json_lib_json_common.rb) = 69aa40256393b75bf246f53302766ebfbe367e30 +SHA1 (patch-ext_json_lib_json_version.rb) = 868cb21e42ded3b891fb09de4d767f7ecc491b55 +SHA1 (patch-ext_json_parser_parser.c) = f17a3c3e65c9783db5e530058ee1c5e5ca1f28a3 +SHA1 (patch-ext_json_parser_parser.rl) = a64baf9d268c5161a061e29a0692583b599dd237 SHA1 (patch-lib_rdoc_ri_driver.rb) = acb4cb022893eb8dea2adf7564f5e5e1a0f1e9c8 SHA1 (patch-lib_rubygems.rb) = 2aed4990a868dc92668a78da7bcff2050ff3dd66 SHA1 (patch-lib_rubygems_commands_install__command.rb) = ff637f39f3fd76b7550fd7f8c32fe303eec6f8c3 @@ -21,10 +26,13 @@ SHA1 (patch-lib_rubygems_installer.rb) = cec82bd0c5255a2a23799273c7a2835e2bef7e3 SHA1 (patch-lib_rubygems_specification.rb) = bc1f844153d00623349ea2d703a979001c9986ec SHA1 (patch-lib_rubygems_uninstaller.rb) = bde19710968f80e56760288d09870a08f3a4ec52 SHA1 (patch-lib_rubygems_version.rb) = 3ec26651ba8f2e6bbd4527e8c0a2f5944833264f -SHA1 (patch-man_erb.1) = 210aa77328689868162566bf01e3ba261dec0c2b -SHA1 (patch-man_irb.1) = 899fdd973bb2491cf7f606ee68ffa6cdbe42f725 -SHA1 (patch-man_ri.1) = 3283b897b8ed36933ccecce158bcb3463d667aff -SHA1 (patch-man_ruby.1) = 8c9edcdc72b674f8f4ef5b35e17aa0a6c38245e7 +SHA1 (patch-man_erb.1) = a8f69ebb02b4d5e1c80b270a3d683c23d8dfbcf1 +SHA1 (patch-man_irb.1) = 58fcccbb5f5f76450715cbf246a018af58d9b57e +SHA1 (patch-man_ri.1) = 25d82d08a9eb74ccc1cbbc1fc324d23f1a56ed64 +SHA1 (patch-man_ruby.1) = 43c638a38bed8257f33d8f5a491acd77a18032b7 +SHA1 (patch-test_json_test__json.rb) = 174f8664ad20bdcdcd7987c4c5234bcfa29e0df4 +SHA1 (patch-test_json_test__json__addition.rb) = 266421cf4f7b844bf354b9bf11cec371d9996e3f +SHA1 (patch-test_json_test__json__string__matching.rb) = e2015f62e21607068e111ade3323207ae65093c8 SHA1 (patch-test_rubygems_test__gem.rb) = fe8b8e436b255595122d2a01462ba0a686575f24 SHA1 (patch-tool_rbinstall.rb) = f0497085a09b31145f57028b30e335b09acabcff SHA1 (patch-vsnprintf.c) = 7bb4ca07381536717518143ef7803634168ca9fa diff --git a/lang/ruby193-base/patches/patch-ext_json_lib_json_add_core.rb b/lang/ruby193-base/patches/patch-ext_json_lib_json_add_core.rb new file mode 100644 index 00000000000..2a02c43a17f --- /dev/null +++ b/lang/ruby193-base/patches/patch-ext_json_lib_json_add_core.rb @@ -0,0 +1,32 @@ +$NetBSD: patch-ext_json_lib_json_add_core.rb,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- ext/json/lib/json/add/core.rb.orig 2011-08-31 07:02:52.000000000 +0000 ++++ ext/json/lib/json/add/core.rb +@@ -36,8 +36,8 @@ class Time + if usec = object.delete('u') # used to be tv_usec -> tv_nsec + object['n'] = usec * 1000 + end +- if respond_to?(:tv_nsec) +- at(*object.values_at('s', 'n')) ++ if instance_methods.include?(:tv_nsec) ++ at(object['s'], Rational(object['n'], 1000)) + else + at(object['s'], object['n'] / 1000) + end +@@ -46,10 +46,13 @@ class Time + # Returns a hash, that will be turned into a JSON object and represent this + # object. + def as_json(*) ++ nanoseconds = [ tv_usec * 1000 ] ++ respond_to?(:tv_nsec) and nanoseconds << tv_nsec ++ nanoseconds = nanoseconds.max + { + JSON.create_id => self.class.name, + 's' => tv_sec, +- 'n' => respond_to?(:tv_nsec) ? tv_nsec : tv_usec * 1000 ++ 'n' => nanoseconds, + } + end + diff --git a/lang/ruby193-base/patches/patch-ext_json_lib_json_common.rb b/lang/ruby193-base/patches/patch-ext_json_lib_json_common.rb new file mode 100644 index 00000000000..262f3325b36 --- /dev/null +++ b/lang/ruby193-base/patches/patch-ext_json_lib_json_common.rb @@ -0,0 +1,54 @@ +$NetBSD: patch-ext_json_lib_json_common.rb,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- ext/json/lib/json/common.rb.orig 2011-08-30 02:25:32.000000000 +0000 ++++ ext/json/lib/json/common.rb +@@ -141,7 +141,7 @@ module JSON + # the default. + # * *create_additions*: If set to false, the Parser doesn't create + # additions even if a matching class and create_id was found. This option +- # defaults to true. ++ # defaults to false. + # * *object_class*: Defaults to Hash + # * *array_class*: Defaults to Array + def parse(source, opts = {}) +@@ -162,7 +162,7 @@ module JSON + # to true. + # * *create_additions*: If set to false, the Parser doesn't create + # additions even if a matching class and create_id was found. This option +- # defaults to true. ++ # defaults to false. + def parse!(source, opts = {}) + opts = { + :max_nesting => false, +@@ -287,11 +287,18 @@ module JSON + # Load a ruby data structure from a JSON _source_ and return it. A source can + # either be a string-like object, an IO-like object, or an object responding + # to the read method. If _proc_ was given, it will be called with any nested +- # Ruby object as an argument recursively in depth first order. ++ # Ruby object as an argument recursively in depth first order. To modify the ++ # default options pass in the optional _options_ argument as well. + # + # This method is part of the implementation of the load/dump interface of + # Marshal and YAML. +- def load(source, proc = nil) ++ def load(source, proc = nil, options = {}) ++ load_default_options = { ++ :max_nesting => false, ++ :allow_nan => true, ++ :create_additions => false ++ } ++ opts = load_default_options.merge options + if source.respond_to? :to_str + source = source.to_str + elsif source.respond_to? :to_io +@@ -299,7 +306,7 @@ module JSON + else + source = source.read + end +- result = parse(source, :max_nesting => false, :allow_nan => true) ++ result = parse(source, opts) + recurse_proc(result, &proc) if proc + result + end diff --git a/lang/ruby193-base/patches/patch-ext_json_lib_json_version.rb b/lang/ruby193-base/patches/patch-ext_json_lib_json_version.rb new file mode 100644 index 00000000000..77d58cf2394 --- /dev/null +++ b/lang/ruby193-base/patches/patch-ext_json_lib_json_version.rb @@ -0,0 +1,14 @@ +$NetBSD: patch-ext_json_lib_json_version.rb,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- ext/json/lib/json/version.rb.orig 2011-07-10 08:01:04.000000000 +0000 ++++ ext/json/lib/json/version.rb +@@ -1,6 +1,6 @@ + module JSON + # JSON version +- VERSION = '1.5.4' ++ VERSION = '1.5.5' + VERSION_ARRAY = VERSION.split(/\./).map { |x| x.to_i } # :nodoc: + VERSION_MAJOR = VERSION_ARRAY[0] # :nodoc: + VERSION_MINOR = VERSION_ARRAY[1] # :nodoc: diff --git a/lang/ruby193-base/patches/patch-ext_json_parser_parser.c b/lang/ruby193-base/patches/patch-ext_json_parser_parser.c new file mode 100644 index 00000000000..c0a3de52056 --- /dev/null +++ b/lang/ruby193-base/patches/patch-ext_json_parser_parser.c @@ -0,0 +1,15 @@ +$NetBSD: patch-ext_json_parser_parser.c,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- ext/json/parser/parser.c.orig 2012-04-16 11:15:31.000000000 +0000 ++++ ext/json/parser/parser.c +@@ -1676,7 +1676,7 @@ static VALUE cParser_initialize(int argc + if (option_given_p(opts, tmp)) { + json->create_additions = RTEST(rb_hash_aref(opts, tmp)); + } else { +- json->create_additions = 1; ++ json->create_additions = 0; + } + tmp = ID2SYM(i_create_id); + if (option_given_p(opts, tmp)) { diff --git a/lang/ruby193-base/patches/patch-ext_json_parser_parser.rl b/lang/ruby193-base/patches/patch-ext_json_parser_parser.rl new file mode 100644 index 00000000000..54e827b69c7 --- /dev/null +++ b/lang/ruby193-base/patches/patch-ext_json_parser_parser.rl @@ -0,0 +1,25 @@ +$NetBSD: patch-ext_json_parser_parser.rl,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- ext/json/parser/parser.rl.orig 2012-04-16 11:15:31.000000000 +0000 ++++ ext/json/parser/parser.rl +@@ -607,6 +607,9 @@ static VALUE convert_encoding(VALUE sour + * defaults to true. + * * *object_class*: Defaults to Hash + * * *array_class*: Defaults to Array ++ * * *quirks_mode*: Enables quirks_mode for parser, that is for example ++ * parsing single JSON values instead of documents is possible. ++ * + */ + static VALUE cParser_initialize(int argc, VALUE *argv, VALUE self) + { +@@ -657,7 +660,7 @@ static VALUE cParser_initialize(int argc + if (option_given_p(opts, tmp)) { + json->create_additions = RTEST(rb_hash_aref(opts, tmp)); + } else { +- json->create_additions = 1; ++ json->create_additions = 0; + } + tmp = ID2SYM(i_create_id); + if (option_given_p(opts, tmp)) { diff --git a/lang/ruby193-base/patches/patch-man_erb.1 b/lang/ruby193-base/patches/patch-man_erb.1 index af34a0e1f18..d3ca14689c8 100644 --- a/lang/ruby193-base/patches/patch-man_erb.1 +++ b/lang/ruby193-base/patches/patch-man_erb.1 @@ -1,4 +1,6 @@ -$NetBSD: patch-man_erb.1,v 1.1 2012/01/24 20:42:42 joerg Exp $ +$NetBSD: patch-man_erb.1,v 1.2 2013/02/12 13:03:09 taca Exp $ + +Fix mdoc markup. --- man/erb.1.orig 2012-01-24 20:07:01.000000000 +0000 +++ man/erb.1 diff --git a/lang/ruby193-base/patches/patch-man_irb.1 b/lang/ruby193-base/patches/patch-man_irb.1 index dd124ce1b7b..6c518ef46bd 100644 --- a/lang/ruby193-base/patches/patch-man_irb.1 +++ b/lang/ruby193-base/patches/patch-man_irb.1 @@ -1,4 +1,6 @@ -$NetBSD: patch-man_irb.1,v 1.1 2012/01/24 20:42:42 joerg Exp $ +$NetBSD: patch-man_irb.1,v 1.2 2013/02/12 13:03:09 taca Exp $ + +Fix mdoc markup. --- man/irb.1.orig 2012-01-24 20:07:49.000000000 +0000 +++ man/irb.1 diff --git a/lang/ruby193-base/patches/patch-man_ri.1 b/lang/ruby193-base/patches/patch-man_ri.1 index 380f0936dfa..9878a21a0a3 100644 --- a/lang/ruby193-base/patches/patch-man_ri.1 +++ b/lang/ruby193-base/patches/patch-man_ri.1 @@ -1,4 +1,6 @@ -$NetBSD: patch-man_ri.1,v 1.1 2012/01/24 20:42:43 joerg Exp $ +$NetBSD: patch-man_ri.1,v 1.2 2013/02/12 13:03:09 taca Exp $ + +Fix mdoc markup. --- man/ri.1.orig 2012-01-24 20:08:14.000000000 +0000 +++ man/ri.1 diff --git a/lang/ruby193-base/patches/patch-man_ruby.1 b/lang/ruby193-base/patches/patch-man_ruby.1 index 8be12bc596c..b92260a6328 100644 --- a/lang/ruby193-base/patches/patch-man_ruby.1 +++ b/lang/ruby193-base/patches/patch-man_ruby.1 @@ -1,4 +1,6 @@ -$NetBSD: patch-man_ruby.1,v 1.1 2012/01/24 20:42:43 joerg Exp $ +$NetBSD: patch-man_ruby.1,v 1.2 2013/02/12 13:03:09 taca Exp $ + +Fix mdoc markup. --- man/ruby.1.orig 2012-01-24 20:08:36.000000000 +0000 +++ man/ruby.1 diff --git a/lang/ruby193-base/patches/patch-test_json_test__json.rb b/lang/ruby193-base/patches/patch-test_json_test__json.rb new file mode 100644 index 00000000000..b3d5d710b95 --- /dev/null +++ b/lang/ruby193-base/patches/patch-test_json_test__json.rb @@ -0,0 +1,55 @@ +$NetBSD: patch-test_json_test__json.rb,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- test/json/test_json.rb.orig 2011-08-30 02:25:32.000000000 +0000 ++++ test/json/test_json.rb +@@ -4,6 +4,7 @@ + require 'test/unit' + require File.join(File.dirname(__FILE__), 'setup_variant') + require 'stringio' ++require 'tempfile' + + unless Array.method_defined?(:permutation) + begin +@@ -263,12 +264,12 @@ class TC_JSON < Test::Unit::TestCase + def test_generation_of_core_subclasses_with_new_to_json + obj = SubHash2["foo" => SubHash2["bar" => true]] + obj_json = JSON(obj) +- obj_again = JSON(obj_json) ++ obj_again = JSON.parse(obj_json, :create_additions => true) + assert_kind_of SubHash2, obj_again + assert_kind_of SubHash2, obj_again['foo'] + assert obj_again['foo']['bar'] + assert_equal obj, obj_again +- assert_equal ["foo"], JSON(JSON(SubArray2["foo"])) ++ assert_equal ["foo"], JSON(JSON(SubArray2["foo"]), :create_additions => true) + end + + def test_generation_of_core_subclasses_with_default_to_json +@@ -414,6 +415,25 @@ EOT + JSON.parse('{"foo":"bar", "baz":"quux"}', :symbolize_names => true)) + end + ++ def test_load ++ assert_equal @hash, JSON.load(@json) ++ tempfile = Tempfile.open('json') ++ tempfile.write @json ++ tempfile.rewind ++ assert_equal @hash, JSON.load(tempfile) ++ stringio = StringIO.new(@json) ++ stringio.rewind ++ assert_equal @hash, JSON.load(stringio) ++ assert_raise(NoMethodError) { JSON.load(nil) } ++ assert_raise(JSON::ParserError) {JSON.load('') } ++ end ++ ++ def test_load_with_options ++ small_hash = JSON("foo" => 'bar') ++ symbol_hash = { :foo => 'bar' } ++ assert_equal symbol_hash, JSON.load(small_hash, nil, :symbolize_names => true) ++ end ++ + def test_load_dump + too_deep = '[[[[[[[[[[[[[[[[[[[[]]]]]]]]]]]]]]]]]]]]' + assert_equal too_deep, JSON.dump(eval(too_deep)) diff --git a/lang/ruby193-base/patches/patch-test_json_test__json__addition.rb b/lang/ruby193-base/patches/patch-test_json_test__json__addition.rb new file mode 100644 index 00000000000..eed25b22059 --- /dev/null +++ b/lang/ruby193-base/patches/patch-test_json_test__json__addition.rb @@ -0,0 +1,104 @@ +$NetBSD: patch-test_json_test__json__addition.rb,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- test/json/test_json_addition.rb.orig 2011-09-01 00:25:52.000000000 +0000 ++++ test/json/test_json_addition.rb +@@ -69,11 +69,19 @@ class TC_JSONAddition < Test::Unit::Test + a = A.new(666) + assert A.json_creatable? + json = generate(a) +- a_again = JSON.parse(json) ++ a_again = JSON.parse(json, :create_additions => true) + assert_kind_of a.class, a_again + assert_equal a, a_again + end + ++ def test_extended_json_default ++ a = A.new(666) ++ assert A.json_creatable? ++ json = generate(a) ++ a_hash = JSON.parse(json) ++ assert_kind_of Hash, a_hash ++ end ++ + def test_extended_json_disabled + a = A.new(666) + assert A.json_creatable? +@@ -100,7 +108,7 @@ class TC_JSONAddition < Test::Unit::Test + c = C.new + assert !C.json_creatable? + json = generate(c) +- assert_raises(ArgumentError, NameError) { JSON.parse(json) } ++ assert_raises(ArgumentError, NameError) { JSON.parse(json, :create_additions => true) } + end + + def test_raw_strings +@@ -118,7 +126,7 @@ class TC_JSONAddition < Test::Unit::Test + assert_match(/\A\{.*\}\Z/, json) + assert_match(/"json_class":"String"/, json) + assert_match(/"raw":\[0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,152,153,154,155,156,157,158,159,160,161,162,163,164,165,166,167,168,169,170,171,172,173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232,233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250,251,252,253,254,255\]/, json) +- raw_again = JSON.parse(json) ++ raw_again = JSON.parse(json, :create_additions => true) + assert_equal raw, raw_again + end + +@@ -126,17 +134,17 @@ class TC_JSONAddition < Test::Unit::Test + + def test_core + t = Time.now +- assert_equal t.inspect, JSON(JSON(t)).inspect ++ assert_equal t, JSON(JSON(t), :create_additions => true) + d = Date.today +- assert_equal d, JSON(JSON(d)) ++ assert_equal d, JSON(JSON(d), :create_additions => true) + d = DateTime.civil(2007, 6, 14, 14, 57, 10, Rational(1, 12), 2299161) +- assert_equal d, JSON(JSON(d)) +- assert_equal 1..10, JSON(JSON(1..10)) +- assert_equal 1...10, JSON(JSON(1...10)) +- assert_equal "a".."c", JSON(JSON("a".."c")) +- assert_equal "a"..."c", JSON(JSON("a"..."c")) ++ assert_equal d, JSON(JSON(d), :create_additions => true) ++ assert_equal 1..10, JSON(JSON(1..10), :create_additions => true) ++ assert_equal 1...10, JSON(JSON(1...10), :create_additions => true) ++ assert_equal "a".."c", JSON(JSON("a".."c"), :create_additions => true) ++ assert_equal "a"..."c", JSON(JSON("a"..."c"), :create_additions => true) + s = MyJsonStruct.new 4711, 'foot' +- assert_equal s, JSON(JSON(s)) ++ assert_equal s, JSON(JSON(s), :create_additions => true) + struct = Struct.new :foo, :bar + s = struct.new 4711, 'foot' + assert_raises(JSONError) { JSON(s) } +@@ -144,24 +152,24 @@ class TC_JSONAddition < Test::Unit::Test + raise TypeError, "test me" + rescue TypeError => e + e_json = JSON.generate e +- e_again = JSON e_json ++ e_again = JSON e_json, :create_additions => true + assert_kind_of TypeError, e_again + assert_equal e.message, e_again.message + assert_equal e.backtrace, e_again.backtrace + end +- assert_equal(/foo/, JSON(JSON(/foo/))) +- assert_equal(/foo/i, JSON(JSON(/foo/i))) ++ assert_equal(/foo/, JSON(JSON(/foo/), :create_additions => true)) ++ assert_equal(/foo/i, JSON(JSON(/foo/i), :create_additions => true)) + end + + def test_utc_datetime + now = Time.now +- d = DateTime.parse(now.to_s) # usual case +- assert_equal d, JSON.parse(d.to_json) ++ d = DateTime.parse(now.to_s, :create_additions => true) # usual case ++ assert_equal d, JSON.parse(d.to_json, :create_additions => true) + d = DateTime.parse(now.utc.to_s) # of = 0 +- assert_equal d, JSON.parse(d.to_json) ++ assert_equal d, JSON.parse(d.to_json, :create_additions => true) + d = DateTime.civil(2008, 6, 17, 11, 48, 32, Rational(1,24)) +- assert_equal d, JSON.parse(d.to_json) ++ assert_equal d, JSON.parse(d.to_json, :create_additions => true) + d = DateTime.civil(2008, 6, 17, 11, 48, 32, Rational(12,24)) +- assert_equal d, JSON.parse(d.to_json) ++ assert_equal d, JSON.parse(d.to_json, :create_additions => true) + end + end diff --git a/lang/ruby193-base/patches/patch-test_json_test__json__string__matching.rb b/lang/ruby193-base/patches/patch-test_json_test__json__string__matching.rb new file mode 100644 index 00000000000..a86efdb3670 --- /dev/null +++ b/lang/ruby193-base/patches/patch-test_json_test__json__string__matching.rb @@ -0,0 +1,26 @@ +$NetBSD: patch-test_json_test__json__string__matching.rb,v 1.1 2013/02/12 13:03:09 taca Exp $ + +Fix for CVE-2013-0269. + +--- test/json/test_json_string_matching.rb.orig 2011-07-10 08:01:04.000000000 +0000 ++++ test/json/test_json_string_matching.rb +@@ -27,14 +27,13 @@ class TestJsonStringMatching < Test::Uni + t = TestTime.new + t_json = [ t ].to_json + assert_equal [ t ], +- JSON.parse(t_json, +- :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\Z/ => TestTime }) ++ JSON.parse(t_json, :create_additions => true, ++ :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\z/ => TestTime }) + assert_equal [ t.strftime('%FT%T%z') ], +- JSON.parse(t_json, +- :match_string => { /\A\d{3}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\Z/ => TestTime }) ++ JSON.parse(t_json, :create_additions => true, ++ :match_string => { /\A\d{3}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\z/ => TestTime }) + assert_equal [ t.strftime('%FT%T%z') ], + JSON.parse(t_json, +- :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\Z/ => TestTime }, +- :create_additions => false) ++ :match_string => { /\A\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}[+-]\d{4}\z/ => TestTime }) + end + end |