diff --git a/CVE-2020-25638.patch b/CVE-2020-25638.patch new file mode 100644 index 0000000..b3943b0 --- /dev/null +++ b/CVE-2020-25638.patch @@ -0,0 +1,371 @@ +From 29aa6dd125fd0d5dba5f525cfa718155c3120b1a Mon Sep 17 00:00:00 2001 +From: zhangtao2020 <18066722603@163.com> +Date: Sat, 12 Dec 2020 17:15:13 +0800 +Subject: [PATCH] CVE-2020-25638 + +--- + .../java/org/hibernate/dialect/Dialect.java | 11 ++ + .../main/java/org/hibernate/sql/Delete.java | 4 +- + .../main/java/org/hibernate/sql/Insert.java | 2 +- + .../java/org/hibernate/sql/InsertSelect.java | 2 +- + .../java/org/hibernate/sql/QuerySelect.java | 2 +- + .../main/java/org/hibernate/sql/Select.java | 2 +- + .../java/org/hibernate/sql/SimpleSelect.java | 2 +- + .../main/java/org/hibernate/sql/Update.java | 2 +- + .../hibernate/test/comments/TestEntity.java | 46 ++++++++ + .../hibernate/test/comments/TestEntity2.java | 37 ++++++ + .../test/comments/UseSqlCommentTest.java | 111 ++++++++++++++++++ + 11 files changed, 214 insertions(+), 7 deletions(-) + create mode 100644 hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java + create mode 100644 hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java + create mode 100644 hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java + +diff --git a/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java b/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java +index 1b0c776..d9ee9e6 100644 +--- a/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java ++++ b/hibernate-core/src/main/java/org/hibernate/dialect/Dialect.java +@@ -36,6 +36,7 @@ import java.util.List; + import java.util.Map; + import java.util.Properties; + import java.util.Set; ++import java.util.regex.Pattern; + + import org.slf4j.Logger; + import org.slf4j.LoggerFactory; +@@ -108,6 +109,9 @@ public abstract class Dialect { + + private static final Set streamBindingLobTypes = new HashSet(); + ++ private static final Pattern ESCAPE_CLOSING_COMMENT_PATTERN = Pattern.compile( "\\*/" ); ++ private static final Pattern ESCAPE_OPENING_COMMENT_PATTERN = Pattern.compile( "/\\*" ); ++ + static { + // Blobs + streamBindingLobTypes.add( BlobType.INSTANCE.getAlternatives().getStreamBindingType() ); +@@ -1998,4 +2002,11 @@ public abstract class Dialect { + // oddly most database in fact seem to, so true is the default. + return true; + } ++ public static String escapeComment(String comment) { ++ if ( StringHelper.isNotEmpty( comment ) ) { ++ final String escaped = ESCAPE_CLOSING_COMMENT_PATTERN.matcher( comment ).replaceAll( "*\\\\/" ); ++ return ESCAPE_OPENING_COMMENT_PATTERN.matcher( escaped ).replaceAll( "/\\\\*" ); ++ } ++ return comment; ++ } + } +diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Delete.java b/hibernate-core/src/main/java/org/hibernate/sql/Delete.java +index 6ec17cc..cf22d4b 100644 +--- a/hibernate-core/src/main/java/org/hibernate/sql/Delete.java ++++ b/hibernate-core/src/main/java/org/hibernate/sql/Delete.java +@@ -28,6 +28,8 @@ import java.util.Iterator; + import java.util.LinkedHashMap; + import java.util.Map; + ++import org.hibernate.dialect.Dialect; ++ + /** + * An SQL DELETE statement + * +@@ -55,7 +57,7 @@ public class Delete { + public String toStatementString() { + StringBuffer buf = new StringBuffer( tableName.length() + 10 ); + if ( comment!=null ) { +- buf.append( "/* " ).append(comment).append( " */ " ); ++ buf.append( "/* " ).append( Dialect.escapeComment(comment)).append( " */ " ); + } + buf.append( "delete from " ).append(tableName); + if ( where != null || !primaryKeyColumns.isEmpty() || versionColumnName != null ) { +diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Insert.java b/hibernate-core/src/main/java/org/hibernate/sql/Insert.java +index 5d8e232..7672654 100644 +--- a/hibernate-core/src/main/java/org/hibernate/sql/Insert.java ++++ b/hibernate-core/src/main/java/org/hibernate/sql/Insert.java +@@ -109,7 +109,7 @@ public class Insert { + public String toStatementString() { + StringBuffer buf = new StringBuffer( columns.size()*15 + tableName.length() + 10 ); + if ( comment != null ) { +- buf.append( "/* " ).append( comment ).append( " */ " ); ++ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " ); + } + buf.append("insert into ") + .append(tableName); +diff --git a/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java b/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java +index 69a54ea..4887fea 100644 +--- a/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java ++++ b/hibernate-core/src/main/java/org/hibernate/sql/InsertSelect.java +@@ -81,7 +81,7 @@ public class InsertSelect { + + StringBuffer buf = new StringBuffer( (columnNames.size() * 15) + tableName.length() + 10 ); + if ( comment!=null ) { +- buf.append( "/* " ).append( comment ).append( " */ " ); ++ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " ); + } + buf.append( "insert into " ).append( tableName ); + if ( !columnNames.isEmpty() ) { +diff --git a/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java b/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java +index f019782..822444c 100644 +--- a/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java ++++ b/hibernate-core/src/main/java/org/hibernate/sql/QuerySelect.java +@@ -135,7 +135,7 @@ public class QuerySelect { + + public String toQueryString() { + StringBuffer buf = new StringBuffer(50); +- if (comment!=null) buf.append("/* ").append(comment).append(" */ "); ++ if (comment!=null) buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " ); + buf.append("select "); + if (distinct) buf.append("distinct "); + String from = joins.toFromFragmentString(); +diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Select.java b/hibernate-core/src/main/java/org/hibernate/sql/Select.java +index 9a52cd4..63ef866 100644 +--- a/hibernate-core/src/main/java/org/hibernate/sql/Select.java ++++ b/hibernate-core/src/main/java/org/hibernate/sql/Select.java +@@ -59,7 +59,7 @@ public class Select { + public String toStatementString() { + StringBuffer buf = new StringBuffer(guesstimatedBufferSize); + if ( StringHelper.isNotEmpty(comment) ) { +- buf.append("/* ").append(comment).append(" */ "); ++ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " ); + } + + buf.append("select ").append(selectClause) +diff --git a/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java b/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java +index 5035eeb..cca2d65 100644 +--- a/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java ++++ b/hibernate-core/src/main/java/org/hibernate/sql/SimpleSelect.java +@@ -156,7 +156,7 @@ public class SimpleSelect { + ); + + if ( comment!=null ) { +- buf.append("/* ").append(comment).append(" */ "); ++ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " ); + } + + buf.append("select "); +diff --git a/hibernate-core/src/main/java/org/hibernate/sql/Update.java b/hibernate-core/src/main/java/org/hibernate/sql/Update.java +index 400fe7c..b8ea145 100644 +--- a/hibernate-core/src/main/java/org/hibernate/sql/Update.java ++++ b/hibernate-core/src/main/java/org/hibernate/sql/Update.java +@@ -181,7 +181,7 @@ public class Update { + public String toStatementString() { + StringBuffer buf = new StringBuffer( (columns.size() * 15) + tableName.length() + 10 ); + if ( comment!=null ) { +- buf.append( "/* " ).append( comment ).append( " */ " ); ++ buf.append( "/* " ).append( Dialect.escapeComment( comment ) ).append( " */ " ); + } + buf.append( "update " ).append( tableName ).append( " set " ); + boolean assignmentsAppended = false; +diff --git a/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java +new file mode 100644 +index 0000000..7c425be +--- /dev/null ++++ b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity.java +@@ -0,0 +1,46 @@ ++/* ++ * Hibernate, Relational Persistence for Idiomatic Java ++ * ++ * License: GNU Lesser General Public License (LGPL), version 2.1 or later. ++ * See the lgpl.txt file in the root directory or . ++ */ ++package org.hibernate.test.comments; ++ ++import javax.persistence.Entity; ++import javax.persistence.Id; ++ ++/** ++ * @author Andrea Boriero ++ */ ++@Entity ++public class TestEntity { ++ @Id ++ private String id; ++ ++ private String value; ++ ++ public TestEntity() { ++ ++ } ++ ++ public TestEntity(String id, String value) { ++ this.id = id; ++ this.value = value; ++ } ++ ++ public String getId() { ++ return id; ++ } ++ ++ public void setId(String id) { ++ this.id = id; ++ } ++ ++ public String getValue() { ++ return value; ++ } ++ ++ public void setValue(String value) { ++ this.value = value; ++ } ++} +diff --git a/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java +new file mode 100644 +index 0000000..58b626d +--- /dev/null ++++ b/hibernate-core/src/test/java/org/hibernate/test/comments/TestEntity2.java +@@ -0,0 +1,37 @@ ++/* ++ * Hibernate, Relational Persistence for Idiomatic Java ++ * ++ * License: GNU Lesser General Public License (LGPL), version 2.1 or later. ++ * See the lgpl.txt file in the root directory or . ++ */ ++package org.hibernate.test.comments; ++ ++import javax.persistence.Entity; ++import javax.persistence.Id; ++ ++/** ++ * @author Andrea Boriero ++ */ ++@Entity ++public class TestEntity2 { ++ @Id ++ private String id; ++ ++ private String value; ++ ++ public String getId() { ++ return id; ++ } ++ ++ public void setId(String id) { ++ this.id = id; ++ } ++ ++ public String getValue() { ++ return value; ++ } ++ ++ public void setValue(String value) { ++ this.value = value; ++ } ++} +diff --git a/hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java b/hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java +new file mode 100644 +index 0000000..2bd6adf +--- /dev/null ++++ b/hibernate-core/src/test/java/org/hibernate/test/comments/UseSqlCommentTest.java +@@ -0,0 +1,111 @@ ++/* ++ * Hibernate, Relational Persistence for Idiomatic Java ++ * ++ * License: GNU Lesser General Public License (LGPL), version 2.1 or later. ++ * See the lgpl.txt file in the root directory or . ++ */ ++package org.hibernate.test.comments; ++ ++import java.util.List; ++import java.util.Map; ++import javax.persistence.EntityManager; ++import javax.persistence.TypedQuery; ++import javax.persistence.criteria.CompoundSelection; ++import javax.persistence.criteria.CriteriaBuilder; ++import javax.persistence.criteria.CriteriaQuery; ++import javax.persistence.criteria.Path; ++import javax.persistence.criteria.Root; ++ ++import org.hibernate.cfg.AvailableSettings; ++import org.hibernate.jpa.test.BaseEntityManagerFunctionalTestCase; ++ ++import org.junit.Before; ++import org.junit.Test; ++ ++import static org.hamcrest.CoreMatchers.is; ++import static org.hibernate.testing.transaction.TransactionUtil.doInJPA; ++import static org.junit.Assert.assertThat; ++ ++/** ++ * @author Andrea Boriero ++ */ ++public class UseSqlCommentTest extends BaseEntityManagerFunctionalTestCase { ++ ++ @Override ++ protected Class[] getAnnotatedClasses() { ++ return new Class[] { TestEntity.class, TestEntity2.class }; ++ } ++ ++ @Override ++ protected void addMappings(Map settings) { ++ settings.put( AvailableSettings.USE_SQL_COMMENTS, "true" ); ++ settings.put( AvailableSettings.FORMAT_SQL, "false" ); ++ } ++ ++ @Before ++ public void setUp() { ++ doInJPA( this::entityManagerFactory, entityManager -> { ++ TestEntity testEntity = new TestEntity(); ++ testEntity.setId( "test1" ); ++ testEntity.setValue( "value1" ); ++ entityManager.persist( testEntity ); ++ ++ TestEntity2 testEntity2 = new TestEntity2(); ++ testEntity2.setId( "test2" ); ++ testEntity2.setValue( "value2" ); ++ entityManager.persist( testEntity2 ); ++ } ); ++ } ++ ++ @Test ++ public void testIt() { ++ String appendLiteral = "*/select id as col_0_0_,value as col_1_0_ from testEntity2 where 1=1 or id=?--/*"; ++ doInJPA( this::entityManagerFactory, entityManager -> { ++ ++ List result = findUsingQuery( "test1", appendLiteral, entityManager ); ++ ++ TestEntity test1 = result.get( 0 ); ++ assertThat( test1.getValue(), is( appendLiteral ) ); ++ } ); ++ ++ doInJPA( this::entityManagerFactory, entityManager -> { ++ ++ List result = findUsingCriteria( "test1", appendLiteral, entityManager ); ++ ++ TestEntity test1 = result.get( 0 ); ++ assertThat( test1.getValue(), is( appendLiteral ) ); ++ } ); ++ } ++ ++ public List findUsingCriteria(String id, String appendLiteral, EntityManager entityManager) { ++ CriteriaBuilder builder = entityManager.getCriteriaBuilder(); ++ CriteriaQuery criteria = builder.createQuery( TestEntity.class ); ++ Root root = criteria.from( TestEntity.class ); ++ ++ Path idPath = root.get( "id" ); ++ CompoundSelection selection = builder.construct( ++ TestEntity.class, ++ idPath, ++ builder.literal( appendLiteral ) ++ ); ++ criteria.select( selection ); ++ ++ criteria.where( builder.equal( idPath, builder.parameter( String.class, "where_id" ) ) ); ++ ++ TypedQuery query = entityManager.createQuery( criteria ); ++ query.setParameter( "where_id", id ); ++ return query.getResultList(); ++ } ++ ++ public List findUsingQuery(String id, String appendLiteral, EntityManager entityManager) { ++ TypedQuery query = ++ entityManager.createQuery( ++ "select new org.hibernate.test.comments.TestEntity(id, '" ++ + appendLiteral.replace( "'", "''" ) ++ + "') from TestEntity where id=:where_id", ++ TestEntity.class ++ ); ++ query.setParameter( "where_id", id ); ++ return query.getResultList(); ++ } ++} +-- +2.27.0 + diff --git a/hibernate3.spec b/hibernate3.spec index 7e6fbe3..2b7350d 100644 --- a/hibernate3.spec +++ b/hibernate3.spec @@ -1,6 +1,6 @@ Name: hibernate3 Version: 3.6.10 -Release: 23 +Release: 24 Summary: Inquiry service and persistence of releationship License: LGPLv2+ URL: http://www.hibernate.org/ @@ -9,6 +9,7 @@ URL: http://www.hibernate.org/ Source0: hibernate-orm-3.6.10.Final.tar.xz Patch0000: hibernate-orm-fix-jacc-gid-aid.patch Patch0001: hibernate-orm-cglib-3.1.patch +Patch0002: CVE-2020-25638.patch BuildArch: noarch @@ -155,5 +156,8 @@ export LANG=en_US.UTF-8 %license lgpl.txt %changelog +* Sat Dec 12 2020 zhangtao - 3.6.10-24 +- CVE-2020-25638 + * Mon Feb 24 2020 wutao - 3.6.10-23 - Package init